Tip · Digital and cyber · 15 Sep 2026 · 2 min read

Data breaches: what to report, and when, within 72 hours

Reportable personal data breaches must reach the ICO within 72 hours of you becoming aware. Every breach needs recording, reported or not.

01 / What's changed

Nothing new. The ICO says a breach that is likely to put people's rights and freedoms at risk must be reported without undue delay and within 72 hours of becoming aware of it.
Sending a letter to the wrong person or losing a device holding personal data both count as breaches.
If you decide a breach is not reportable, you must be able to justify that decision, and you must record every breach either way.

All UK practices and PCNs. In England, practices can use the incident reporting tool in the DSPT for the initial notification.

Tell staff to report a suspected breach internally straight away, even if they are unsure. NHS England's guidance asks staff to raise breaches as soon as they become apparent.
Keep a breach log covering the facts, the effects and what you did about it, including breaches you did not report.
If you cannot finish investigating within 72 hours, notify on time and send further details in phases.
If the risk to people is high, tell those affected directly, in plain language, with practical steps they can take. After the initial DSPT notification, send updates to the ICO directly, as the DSPT entry cannot be edited.