Most business owners picture the ICO as the organisation that hands out fines for a data breach. In practice, the regulator works on risk. Fines and reprimands are kept for organisations that ignore the law, sit on breaches they know about, or try to cover things up. Most organisations get guidance instead. (If you’d like the wider picture beyond data protection, see what regulators expect from your IT.)
So a better question is: if something goes wrong, can we show we did the right things? Here’s what that looks like, starting with when to report a data breach and when you only need to record it.
Types of data breach, and which ones you need to report
A personal data breach is wider than most people think. It isn’t just stolen data. If personal data is lost, altered, seen by the wrong person, or simply unavailable, it counts. The ICO groups these into three types of data breach:
- Confidentiality breaches: personal data is seen by, or sent to, someone who shouldn’t have it. An email with a customer’s details sent to the wrong person is one.
- Integrity breaches: personal data is changed without permission, for example a payroll record altered by someone who got into an account.
- Availability breaches: personal data is lost or can’t be reached. A ransomware attack that locks your files is a breach even if nothing was copied.
Not every incident needs reporting, but every breach needs recording. The rules are straightforward:
- Report it to the ICO within 72 hours of becoming aware, unless it’s unlikely to put anyone at risk.
- Tell the people affected without undue delay if the risk to them is high.
- Record every breach, reported or not, in an internal breach log: what happened, the effect, what you did about it, and why you did or didn’t report it.
That last one is the most often missed. If a regulator ever asks to see your breach log, an empty one doesn’t say “nothing happened”. It says “nobody was writing it down”.
How long do you have to report a data breach?
As a data controller, you must inform the ICO of a reportable data breach within 72 hours of becoming aware of it. That deadline worries people because, three days in, you rarely have the full picture. The law allows for that. Your first data breach notification to the ICO can cover what you know, say what you don’t know yet, and add detail later as your investigation goes on.
Who do you report a data breach to?
In the UK, you report it to the ICO, either online or through its helpline (0303 123 1113). If you can’t tell whether something needs reporting, the ICO also has an online self-assessment tool for exactly this. If you’re not sure, ask early. Asking for advice won’t count against you. Staying quiet might.
Who’s responsible: you or your IT provider?
This is where a lot of confusion lives. Most businesses hold personal data about customers, staff and suppliers, which makes them the controller of that data. Your IT provider, cloud services and software suppliers usually act as processors on your behalf.
In practice that means:
- Your provider’s job: keep the service secure, tell you quickly if something goes wrong, and help you deal with it.
- Your job: decide what data goes where, how services are configured, and whether a breach gets reported. That decision can’t be handed over, even when everything is outsourced.
So, if you ask your IT provider to switch off a security control because it’s getting in the way, a good provider will put the risk in writing and ask you to confirm. That way, everyone’s clear about who decided what.
The same applies to contracts. UK GDPR requires specific terms between you and anyone processing personal data for you, including how they’ll tell you about a breach. It’s worth checking that yours say so.
The basics get checked first
After an incident, the first questions are rarely exotic. They’re the basics:
- Was multi-factor authentication switched on?
- Who had admin rights, and did they need them?
- Were systems patched and protected?
These are some of the areas that Cyber Essentials covers, which makes it a sensible minimum whether or not you hold the certificate.
Beyond that, expect questions about:
- Logs that someone regularly reviews
- Encryption, especially for sensitive data such as health information
- Your incident and continuity plans, and whether they were tested before you needed them
One point catches people out: restoring from backup doesn’t make the problem go away. If data was copied before it was encrypted, the people it belongs to are still at risk.
And data that’s simply unavailable can cause real harm. In 2025, an NHS trust confirmed that delays caused by a ransomware attack on a pathology supplier were among the factors in a patient’s death. So data being unavailable is a data protection problem too, and it’s why disaster recovery planning matters as much as prevention.
What’s changed, and what’s coming
Complaints now have a legal deadline. Since 19 June 2026, under the Data (Use and Access) Act 2025, organisations must acknowledge a data protection complaint within 30 days, investigate it, and keep the person updated. The ICO also expects people to complain to you before going to them. If you don’t have a simple complaints process, now is the time to set one up.
The regulator has a new name. The Information Commissioner’s Office became the Information Commission on 30 September 2026. It still goes by “ICO”. If your privacy notice spells out the old name, update it at your next review. There’s no need to rush.
IT providers are about to be regulated. The Cyber Security and Resilience Bill, going through Parliament now, is expected to bring medium and large managed service providers under regulation for the first time, with the ICO as their regulator. That will come with tighter incident reporting: an initial report within 24 hours and a fuller one within 72.
For businesses that rely on an IT provider, that’s a welcome step. Until it becomes law, and for providers it won’t cover, independent checks are the best guide. Ingenio was the second MSP in the UK, and the first IT provider in Sussex and the South East, to earn the Assurix Trustmark, independently checked against 59 controls. So you can see the evidence rather than take our word for it.
Five things to do this month
- Start a breach log. Note what happened, who it affected, what you did, and whether you reported it.
- Know who makes the call. Who decides whether to report, and can they reach your IT provider and insurer out of hours? Speed matters: when Posture People’s account was taken over on a Friday afternoon, a fast response got the hacker out of the account for good.
- Check the basics. Multi-factor authentication everywhere, admin rights only where needed and updates applied promptly.
- Write a plan, then test it. One page will do. Then talk it through with the people involved, using a made-up incident. A short practice run finds the gaps before a real incident does.
- Decide how you’d tell people. Have a plain-language message ready, a place to post updates, and a warning to watch for scam emails pretending to be from you.
Final thought
Ingenio helps businesses across the South East get the basics right and be ready when something goes wrong. We cover Cyber Essentials, security reviews, incident response planning and practice runs to test your plan.
👉 If you’d like a second pair of eyes on where you stand, get in touch through our contact form or call us on 01273 806211. We’re happy to talk it through.
