What should you do after a data breach? a guide for uk businesses

Discovering a data breach is one of the most stressful moments a business can face. Whether it is a sophisticated cyber attack, an email sent to the wrong person or a lost laptop, the decisions made in the first few hours can shape the potential consequences for your organisation, your customers and your reputation.

Under UK GDPR, organisations have clear legal obligations once a personal data breach occurs, including strict deadlines for ICO reporting. Yet many businesses only discover what those obligations are in the middle of an incident, when time and clear thinking are in short supply.

This guide explains what to do after a data breach, from securing affected systems and carrying out a risk assessment to notifying the Information Commissioner’s Office (ICO) and affected individuals. It also covers how to reduce the risk of future breaches.

If you are reading this because your organisation has experienced a cyber incident and is unsure how to respond, contact Zensec immediately.

What counts as a personal data breach?

A data breach can take many forms. The ICO describes a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

That covers far more than cyber attacks. Common examples include:

• Unauthorised access to customer data or employee records by cyber criminals

• A data leak caused by a misconfigured cloud system or database

• An email containing sensitive information sent to the wrong person

• A lost or stolen device holding personally identifiable information

• Ransomware that encrypts or deletes personal data, making it unavailable

• Human error, such as uploading customer details to a public website

Not every security incident is a personal data breach. An incident that exposes only intellectual property or commercial information may not trigger UK GDPR obligations, although it can still cause serious financial loss and reputational damage. The key question is whether personal data is affected.

Step 1: Contain the breach and secure affected systems

Your first priority is to stop the breach getting worse. Your IT team or incident response team should work quickly to isolate affected systems, block unauthorised access and preserve evidence.

Depending on the situation, this may involve:

• Disconnecting compromised devices from the network

• Disabling compromised accounts and forcing password resets

• Changing passwords for shared, administrator and service accounts

• Recalling a misdirected email or asking the recipient to delete it

• Preserving logs and forensic evidence before systems are rebuilt

Speed matters, but acting without information can make things worse. Wiping a compromised server, for example, may destroy the evidence needed to understand how the breach occurred. Where a sophisticated cyber attack is suspected, specialist incident responders can help contain the threat while protecting that evidence.

Step 2: Start a detailed log straight away

From the moment you become aware of a breach, keep a detailed log. Record what happened, when it was discovered, the data involved, who has been informed and every action taken, with times and dates.

UK GDPR requires every data controller to document all personal data breaches, including those that do not need to be reported. This record helps you demonstrate compliance to regulatory bodies, supports any ICO notification and gives you a clear basis for reviewing lessons learned once the incident is closed.

Step 3: Carry out a risk assessment

Once the immediate threat is contained, you need to understand the likely risk to the people whose personal data has been affected. This risk assessment determines whether you must report the breach and whether you need to inform individuals.

Consider:

• What type of personal data is affected, and whether it includes special category data such as health information

• How much data is involved and how many people are affected

• Whether the compromised data was encrypted or otherwise protected

• Who now has access to the data, and whether they are likely to misuse it

• The likely consequences for affected individuals, such as identity theft, fraud, financial loss or distress

The aim is to judge the potential harm realistically. An encrypted laptop left on a train presents a very different level of risk from a database of sensitive data being published online by a criminal group.

If your organisation has a data protection officer (DPO), involve them from the start. They should advise on the risk assessment and on your obligations under data protection laws.

Step 4: Report the breach to the ICO within 72 hours where required

Under UK GDPR, a data controller must report a personal data breach to the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. In the UK, that authority is the Information Commissioner’s Office (ICO). You do not need to report a breach that is unlikely to result in a risk to people’s rights and freedoms, but you must be able to justify that decision.

The 72 hours are not working hours. They include evenings and weekends, so this legal requirement can arrive quickly. If you do not yet have every detail, you can make an initial report and provide further information as your investigation continues. If you report after the deadline, you must explain the reasons for the delay.

Your breach notification should include:

• A description of the breach, including the categories and approximate number of individuals and records concerned

• The name and contact details of your data protection officer or another point of contact

• The likely consequences of the breach

• The security measures you have taken, or plan to take, to deal with the breach and reduce harm

If you decide that you do not need to notify the ICO, record your reasoning in your log. Failing to report a breach when required can lead to significant fines, on top of the damage the breach itself causes.

Some organisations have additional rules to follow. Providers of public electronic communications services, such as telecoms and internet service providers, are also covered by the Privacy and Electronic Communications Regulations (PECR), which require them to notify the ICO within 24 hours of detecting a personal data breach. Organisations in regulated sectors, such as financial services, may also need to inform other regulatory bodies.

Step 5: Notify affected individuals without undue delay

Where a breach is likely to result in a high risk to people’s rights and freedoms, you must also notify affected individuals without undue delay. The threshold is higher than for reporting the breach to the ICO, but the purpose is simple: to help people protect themselves.

When you inform customers, employees or other affected parties, clear communication is essential. Explain in plain language:

• What happened and when

• What personal data was involved

• The likely consequences for them

• What you are doing to deal with the breach

• What they can do to protect themselves, such as changing passwords, watching for phishing emails or monitoring bank statements

• Who they can contact for more information

Avoid technical jargon and resist the temptation to downplay what happened. An honest, well-timed message helps rebuild trust and limits reputational damage.

You may also need to contact other businesses, such as suppliers, partners or your cyber insurer, if their data or systems are affected or your contracts require it.

Step 6: Investigate the root cause

Containment stops the immediate damage, but it does not explain why the breach happened. A thorough investigation should establish how the breach occurred, whether attackers still have access and whether any other systems have been compromised.

The cause might be a phishing email, an unpatched vulnerability, weak access controls or simple human error. Without understanding it, you risk fixing the symptoms while leaving the original weakness in place.

For a cyber incident such as ransomware, specialist forensic support can help you trace the attacker’s actions, confirm what data was accessed and provide the evidence that the ICO, insurers and other affected parties may ask for. The National Cyber Security Centre (NCSC) also publishes incident management guidance to help organisations structure their response.

Step 7: Strengthen your defences to prevent future breaches

Once the investigation is complete, use what you have learned to reduce the risk of future breaches. Typical improvements include:

• Enforcing multi-factor authentication and stronger access controls

• Patching vulnerabilities promptly

• Encrypting sensitive data at rest and in transit

• Reviewing who has access to personal data and why

• Delivering regular staff training on phishing, data handling and incident reporting

• Testing and updating your data breach response plan

Why every business needs a data breach response plan

The organisations that handle breaches best are rarely the ones that never experience them. They are the ones that have prepared. A data breach response plan sets out who does what, who makes decisions, how risk is assessed and how reporting deadlines will be met.

A good response plan should name your response team, including IT, legal, data protection, communications and senior leadership. It should include templates for ICO reporting and for messages to customers, along with contact details for external specialists. Testing the plan through tabletop exercises means your team is not working it out for the first time under pressure.

Cyber security and data protection are closely linked. Strong security measures reduce the likelihood of a breach, while a clear, tested plan reduces the impact when one happens.

Key takeaways

• A personal data breach can take many forms, from cyber attacks to an email sent to the wrong person

• Contain the breach quickly, secure affected systems and keep a detailed log

• Carry out a risk assessment to understand the potential harm to individuals

• Report the breach to the ICO within 72 hours where there is a risk to individuals

• Notify affected individuals without undue delay where there is a high risk

• Investigate the root cause and strengthen your defences to prevent future breaches

• Prepare and test a data breach response plan before you need it

If your organisation is dealing with a data breach or cyber incident, Zensec can help. As an NCSC Assured Service Provider, our incident response team deploys the same day to triage, investigate, contain and remediate the threat, then help you recover and learn from what happened. Contact Zensec immediately.