After a breach, a UK business has three jobs that run in parallel: contain the damage without destroying evidence, decide within hours whether the ICO and affected people must be told, and record every decision as you make it. The clock matters most. If personal data is at risk, the 72-hour reporting window starts when you become aware of the breach, not when the investigation ends. This guide walks through the steps in the order you will need them, for firms that hold sensitive client, patient or customer data and cannot afford to improvise.
TL;DR
- Contain first, but do not power systems off or wipe anything: keep logs and data intact so the cause can be found.
- Put a named leader in charge within the first hours and open a written breach log straight away.
- If the breach poses a risk to individuals, report it to the ICO within 72 hours of becoming aware. Send what you know and add the rest in phases.
- Tell affected people without undue delay when the risk to them is high, with clear advice on what they can do.
- Recovery is not the end: run a formal post-incident review and fix the weaknesses that let the attacker in.
Table of Contents
- Step 1: Contain the breach without destroying evidence
- Step 2: Put one person in charge
- Step 3: Assess what happened and who is at risk
- Step 4: Decide whether to report to the ICO, and by when
- Step 5: Tell the people affected
- Step 6: Keep a breach log from the first minute
- Step 7: Remove the threat and recover
- Step 8: Review what happened and close the gaps
- Where we can take work off your hands
- Our view: the breach is decided before it happens
- FAQ
- Sources
Step 1: Contain the breach without destroying evidence
The GOV.UK Model Action Plan (15 July 2026) says to contain the breach immediately, using a mix of technical and physical actions. On the technical side that means:
- isolating affected systems
- disabling compromised accounts
- revoking access privileges
- blocking the external threat
- recalling documents sent in error
- asking recipients to delete data immediately and thoroughly
On the physical side it means disabling lost key cards and recovering lost devices or paperwork.
The common mistake is treating containment as shutting everything down. Gowling WLG points out that containment means limiting the attacker’s movement while keeping logs and data intact. It also means capturing live snapshots of affected systems and preserving evidence with a proper chain of custody. Bratby Law adds a reason: restoring systems too early overwrites the record of what the attacker did.
The NCSC adds a subtler point in its incident management guidance. Think through the consequences of each containment action, good and bad. An attacker may react to what you do or bury themselves deeper, and sometimes it is better to monitor and analyze a little longer before acting. That is a judgment call, and it is where experienced responders earn their keep.
Write down each action, who authorized it and when it was completed. You will need that record later.
Step 2: Put one person in charge
In a serious incident, confusion about who decides costs more time than any technical problem. The NCSC’s guidance, What to do when cyber attacks disrupt your organisation (July 2026), says that in the first hours you should set up a clear governance structure. The CEO normally leads, delegating to other senior executives. It suggests an incident command structure of Gold, Silver and Bronze:
- Gold is strategic.
- Silver is tactical.
- Bronze is operational.
In practice, for a law firm, a financial services business or a healthcare provider, this means:
- Name the incident lead and a deputy.
- Name who owns communications, so staff, clients and the press hear one version.
- Bring in legal advice in parallel with the technical work, as the Model Action Plan expects.
- Keep the incident plan and key contact details somewhere you can reach if your network is down. Gowling WLG recommends storing them offline.
If your plan lives on the file server that was just encrypted, it is no use to you.
Step 3: Assess what happened and who is at risk
Containment buys time. Assessment tells you what you owe to whom. The ICO’s guide to personal data breaches says to assess the potential adverse consequences for individuals: how serious they are and how likely they are to happen. The ICO’s breach assessment toolkit lists what to weigh, case by case:
- the type of breach
- the type, sensitivity and volume of the personal information
- how vulnerable the affected people are
- how many people are affected
- whether the incident has been contained
- who has had access since
- the consequences after mitigation
The Model Action Plan frames the central question as the risk to people’s rights and freedoms: safeguarding issues, identity theft or significant distress, for example. A misdirected email with one marketing contact is a different event from a patient file set or a client matter database in an attacker’s hands.
Two cautions apply while you assess. First, keep confirmed facts separate from assumptions in your notes, and update them as the picture changes. Second, remember that a firm does not need absolute certainty to act. The ICO’s position, as summarized in Clifford Chance’s briefing on the Marriott penalty, is that you must be able reasonably to conclude a personal data breach has likely occurred to trigger notification.
Step 4: Decide whether to report to the ICO, and by when
A personal data breach, in plain terms, is a security incident that affects the confidentiality, integrity or availability of personal data. That covers theft by an attacker, but also data sent to the wrong person, a lost laptop, or data made unavailable by ransomware.
The rule is simple to state. Business.gov.uk says you must notify the ICO of any breach that poses a risk to individuals within 72 hours of becoming aware of it. If you miss the window, the Model Action Plan says you must give a clear reason for the delay.
Three practical points:
- The clock does not pause for weekends. Make UK notes that the 72 hours makes no distinction between working and non-working hours.
- Do not wait for a full picture. If you lack all the information, send what you have, explain why, and provide the rest in phases.
- Decide quickly. Bratby Law says triage has to happen within hours, not days, to settle whether a notifiable breach has occurred and which regulators need to know.
If you also provide public electronic communications services, the separate PECR rules apply. The ICO says the Data Use and Access Act moved the PECR breach reporting deadline from 24 to 72 hours from 20 August 2025.
Regulated firms often have more than one audience. Bratby Law advises settling the ICO notification, any Ofcom notification and any FCA or other regulator notification together so they tell a consistent story. If you are a financial services firm, bring your compliance lead in at the start, not after the ICO report has gone.
The NCSC and the ICO both say that more reporting duties are coming for some sectors. GOV.UK describes proposed requirements under the Cyber Security and Resilience Bill, with an initial notification within 24 hours and a full report within 72 hours for certain operators. These would come into force through secondary legislation after Royal Assent, so check the current status before relying on them.
Step 5: Tell the people affected
Where the breach is likely to result in a high risk to people’s rights and freedoms, you must tell them without undue delay. Business.gov.uk gives the typical trigger: personal data accessed in a way that could cause harm such as fraud, identity theft or financial loss.
The Model Action Plan sets out what a formal notification must contain:
- the nature of the breach
- the likely consequences
- the measures taken or proposed
- your contact details
In plain language, add what people can do to protect themselves, such as changing passwords or watching for phishing messages that use the stolen details.
There are narrow exceptions. Make UK lists them: the data was protected, for example by encryption; later measures mean the high risk is no longer likely; or contacting each person would take disproportionate effort, in which case a public statement is required. It also notes that you are unlikely to be able to use the disproportionate effort exemption for current employees. Do not assume an exemption applies. Record your reasoning for the decision either way.
Step 6: Keep a breach log from the first minute
The ICO is explicit: record all breaches, whether or not they must be reported. Article 33(5) of the UK GDPR requires you to document the facts, the effects and the action taken, and the ICO’s logging toolkit warns that without proper logging it may be unable to verify your compliance.
A useful log captures, at a minimum:
- when the incident occurred, when it was discovered and when you became aware
- the systems and locations involved
- the categories and approximate volume of data, and the number and type of people affected
- containment and recovery measures, with who authorized them
- the risk assessment and the notification decision, with reasons
- who is responsible for the investigation and communications
That list follows WDPs’ guidance on the first 72 hours (August 2026). If you are building the habit across teams, this overview of UK GDPR compliance for apps shows how the same record-keeping duties apply to the software that collects personal data.
Step 7: Remove the threat and recover
The NCSC’s incident management guidance separates two stages. Remediate or eradicate aims to remove the threat fully from your network and systems. Recover returns systems to business as usual, with clean systems and data put back online. The GOV.UK incident response playbook says recovery includes restoring from backups taken before the incident, adjusting processes or technology to manage risks, removing temporary measures and running a fresh threat assessment.
For a major disruption, the NCSC recommends running recovery as a formal programme. It should aim first for minimum viable operations: the lowest level at which you can still safely meet your legal and regulatory obligations and keep the trust of customers, partners and staff. Each recovery workstream should have a named lead.
Two points often missed:
- Backups need to be clean. Restoring from a backup that already contains the intruder’s foothold restarts the incident. Gowling WLG’s baseline is the 3-2-1 rule: three copies of data, on two types of storage, with one offline.
- Plans must have been rehearsed. The NCSC blog on helping organisations recover (28 July 2026) urges organizations to practice shutdown and restart procedures and test rebuilding from backups, rather than only writing a plan down. For a broader view of what regular drills look like, see these monthly emergency preparedness tests.
If the incident is ransomware, our guide on keeping UK services running during recovery goes deeper. For the difference between the two disciplines, see incident response versus disaster recovery.
Step 8: Review what happened and close the gaps
The end of the 72-hour window is not the end of the response. WDPs lists what comes next: keep investigating, update your assessment, send the ICO further information if your first notification was incomplete, answer questions from affected people, tell processors, suppliers and insurers what they need to know, complete a root-cause analysis and keep the breach record and evidence.
The Model Action Plan expects a thorough post-incident review of every incident reported to the ICO. It should cover:
- how the breach occurred
- how long it took to identify
- whether the response followed your policies
- how people were notified
- whether recording and reporting processes were followed
- how quickly legal advice was brought in
The NCSC splits the review into two kinds of lesson: security improvements that could have prevented or earlier detected the incident, and how well the response itself worked, including whether useful data was unavailable. The GOV.UK playbook says to hold the debrief openly and without assigning blame, then turn lessons into action plans with owners and deadlines.
The regulator looks at your security before the breach too. In the Marriott case, the ICO identified four avoidable failures: weak monitoring of privileged accounts, weak monitoring of databases, insufficient controls on critical systems and a lack of encryption. The penalty was reduced in part because of Marriott’s continued investment in security. Business.gov.uk also suggests completing Cyber Essentials certification, following NCSC guidance and considering cyber insurance once the incident is resolved.
A sensible post-breach hardening list covers:
- Multi-factor authentication and least-privilege access everywhere.
- Real-time monitoring and log management, so the next intrusion is spotted in hours, not months.
- A vulnerability management process with named owners for every finding.
- Independent cyber security testing to confirm the fixes hold.
Where we can take work off your hands
Most of the steps above depend on two things you either have in place or do not: visibility into what the attacker touched, and people who can act at 2 a.m. Zero Through provides managed SOC and SIEM services, MDR, penetration testing and IT security audits, with rapid incident response for multi-location businesses in regulated sectors. Our support is scalable and tailored to your operations, and we explain findings in clear terms with an actionable roadmap rather than a generic checklist.
If you have just had a breach, or want to be ready before one, talk to us through Global IT Support.
Our view: the breach is decided before it happens
In our experience of building security support for multi-location businesses, the businesses that handle a breach well are rarely the ones with the longest plan. They are the ones who can answer three questions in the first hour: what was touched, who is leading, and where are the logs.
That is why we put monitoring first. Managed SIEM and SOC services give you the record of what an attacker did, which is what the ICO assessment, the notification decision and the root-cause analysis all depend on. MDR adds people who act on that record quickly.
After the incident, our approach is to explain what we find in clear terms and turn it into a roadmap your team can follow, with penetration testing and a security audit to confirm the gaps are closed. Scalable, customizable support means the same arrangement works as you add sites, regions and regulators.
The 72 hours are short. The firms that meet them comfortably have usually done the preparation months earlier.
Shirish
FAQ
What should be the first action when a breach is identified?
Contain it. Isolate affected systems, disable compromised accounts and revoke access, but keep logs and data intact so the cause can be investigated. At the same time, name an incident lead, start a written log and bring in legal advice.
Who needs to be notified of a breach in the UK?
The ICO must be told within 72 hours of you becoming aware, if the breach poses a risk to individuals. Affected people must be told without undue delay if the risk to them is high. Regulated firms may also need to notify the FCA, Ofcom or another sector regulator, and settle those messages together.
What counts as a personal data breach under UK GDPR?
It is a security incident that affects the confidentiality, integrity or availability of personal data. Theft by an attacker counts, and so do data sent to the wrong recipient, a lost device or ransomware that locks you out of personal data.
Do I have to report every breach to the ICO?
No, but you must record every breach. The ICO says Article 33(5) requires you to document the facts, effects and action taken whether or not you report. Your log should also show why you decided not to notify.
Sources
- Responding to a cyber attack on your business, Business.gov.uk
- Model Action Plan for Responding to Significant Data Breaches, GOV.UK
- How should businesses respond to a cyber-attack? Gowling WLG
- Incident management, NCSC
- What to do when cyber attacks disrupt your organisation, NCSC
- Personal data breaches: a guide, ICO
- Breach identification, assessment and logging, ICO
- UK Information Commissioner imposes second significantly large GDPR penalty, Clifford Chance
- Breach and tell? Make UK
- Security breaches, ICO
- Incident reporting, GOV.UK
- Personal Data Breach Response: The First 72 Hours, WDPs
- Incident response, GOV.UK
- When cyber attacks happen: helping organisations recover, NCSC
