# Data breaches: what to report, and when, within 72 hours

> Reportable personal data breaches must reach the ICO within 72 hours of you becoming aware. Every breach needs recording, reported or not.

- Published: 15 Sep 2026
- Type: Tip
- Topic: Digital and cyber
- For: Practice managers, PCN leads
- Applies to: UK-wide
- Review: Reviewed by the Abtrace team
- Web page: https://ontherecord.abtrace.com/posts/data-breach-72-hour-reporting/

## What's changed

- Nothing new. The ICO says a breach that is likely to put people's rights and freedoms at risk must be reported without undue delay and within 72 hours of becoming aware of it.
- Sending a letter to the wrong person or losing a device holding personal data both count as breaches.
- If you decide a breach is not reportable, you must be able to justify that decision, and you must record every breach either way.

## Who it affects

All UK practices and PCNs. In England, practices can use the incident reporting tool in the DSPT for the initial notification.

## What to do

- Tell staff to report a suspected breach internally straight away, even if they are unsure. NHS England's guidance asks staff to raise breaches as soon as they become apparent.
- Keep a breach log covering the facts, the effects and what you did about it, including breaches you did not report.
- If you cannot finish investigating within 72 hours, notify on time and send further details in phases.
- If the risk to people is high, tell those affected directly, in plain language, with practical steps they can take. After the initial DSPT notification, send updates to the ICO directly, as the DSPT entry cannot be edited.

## Sources

- [ICO: Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/)
- [DSPT: Frequently asked questions](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions)
- [NHS England: Information governance and data protection](https://www.england.nhs.uk/long-read/information-governance-and-data-protection/)

Published by Abtrace on On the Record (https://ontherecord.abtrace.com/). Summaries only; always check the linked source.