When must a data breach be reported to the ICO under UK GDPR?

Under Article 33(1) of the UK GDPR (as retained in UK law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), a data controller must notify the Information Commissioner's Office (ICO) of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The 72-hour clock starts when the controller has a reasonable degree of certainty that a security incident has occurred and that personal data has been affected. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is not made within 72 hours, the controller must provide reasons for the delay along with the notification. Processors must notify the controller without undue delay after becoming aware of a breach — Section 108 of the Data Protection Act 2018 reinforces this processor obligation. The ICO's self-reporting tool is available at ico.org.uk and allows phased reporting where information is not immediately available.

What information must be included in a UK GDPR breach notification to the ICO?

Article 33(3) of the UK GDPR specifies that the notification to the ICO must include at a minimum: (a) a description of the nature of the breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records affected; (b) the name and contact details of the Data Protection Officer or other contact point from whom more information can be obtained; (c) a description of the likely consequences of the breach; and (d) a description of the measures taken or proposed to be taken by the controller to address the breach, including, where appropriate, measures to mitigate its possible adverse effects. Article 33(4) allows this information to be provided in phases where it is not possible to provide it all at once, without undue delay. The ICO expects controllers to document all breaches, including those that do not meet the threshold for ICO notification, in an internal breach register under Article 33(5).

When must affected individuals be notified about a data breach?

Under Article 34(1) of the UK GDPR, a controller must communicate a personal data breach to the data subject without undue delay when the breach is likely to result in a high risk to the rights and freedoms of natural persons. The threshold for notifying individuals (high risk) is higher than the threshold for notifying the ICO (risk). The ICO has issued guidance identifying factors that indicate a high risk, including: exposure of sensitive categories of data (health, financial, criminal), data relating to vulnerable individuals or children, large volumes of data, data that enables identity theft or fraud, and circumstances where individuals cannot protect themselves without warning. Article 34(2) requires the notification to describe the nature of the breach in clear and plain language and to include the DPO's contact details, the likely consequences, and the measures taken or proposed. Article 34(3) sets out three circumstances in which individual notification is not required: adequate technical protections were in place (such as encryption), the controller has taken subsequent measures to eliminate the high risk, or individual notification would involve disproportionate effort (in which case a public communication must be made instead).

What is the ICO's enforcement approach for failure to notify a breach?

The ICO has significant enforcement powers for breach notification failures under the UK GDPR and Data Protection Act 2018. Failure to notify a reportable breach within the 72-hour timeframe, or failure to notify data subjects where required under Article 34, can result in an administrative fine of up to £17.5 million or 4% of total worldwide annual turnover (whichever is higher) under the upper tier, or up to £8.7 million or 2% of turnover under the lower tier. However, in practice the ICO takes a proportionate approach and considers: whether the breach was caused by factors outside the controller's control; whether the controller took prompt remediation steps; whether the controller has a mature data protection governance framework in place; and whether there is evidence of systemic or repeated failures. The ICO has stated that transparency and prompt reporting are viewed favourably and may reduce the severity of any regulatory action. Conversely, actively concealing a breach or delaying notification without good reason is treated as an aggravating factor.

What additional obligations apply under the NIS Regulations 2018 for a cyber incident?

The Network and Information Systems (NIS) Regulations 2018 (SI 2018/506) implement the EU's NIS Directive in UK law and impose additional incident reporting obligations on operators of essential services (OES) and relevant digital service providers (RDSP). Operators of essential services in sectors such as energy, transport, water, health, and digital infrastructure must report incidents that have a significant impact on service continuity to the relevant competent authority (which varies by sector — for example, the ICO for digital infrastructure) without undue delay and, where feasible, within 72 hours of becoming aware of the incident. Relevant digital service providers (online marketplaces, online search engines, and cloud computing services) must report incidents to the ICO within 72 hours where the incident has a substantial impact on the provision of their services. If a security incident also constitutes a personal data breach, both the ICO (as supervisory authority under UK GDPR) and, where applicable, the relevant NIS competent authority may need to be notified. Following Brexit, UK-based RDSP/OES no longer have obligations under the EU NIS Directive but remain subject to the domestic NIS Regulations 2018.

Must data breaches that are not reported to the ICO still be documented?

Yes. Under Article 33(5) of the UK GDPR, the controller must document all personal data breaches, regardless of whether they are required to be notified to the ICO. This documentation must include the facts relating to the breach, its effects, and the remedial action taken. This internal breach register forms part of the controller's accountability obligations under Article 5(2) (the accountability principle) and enables the ICO to verify compliance with the notification obligations during an investigation or audit. The ICO's accountability framework guidance recommends that breach documentation includes: the date and time of discovery; the date and time of the breach (if known); a description of the nature of the breach; the categories and approximate number of data subjects and records involved; the likely consequences; the remedial measures taken; and the risk assessment conducted. The ICO expects this register to be readily available for inspection, as failure to maintain adequate records can itself constitute a UK GDPR violation.

GDPR Data Breach Notification Form (England & Wales)

GDPR Data Breach Notification

UK GDPR Articles 33–34 & Data Protection Act 2018

PERSONAL DATA BREACH NOTIFICATION

Prepared pursuant to UK GDPR Articles 33–34 and the Data Protection Act 2018

1. ORGANISATION DETAILS

Organisation Name: [Organisation Name]

Registered or Principal Address: [Organisation Street], [Organisation City], [Organisation Postcode], England

2. DATA PROTECTION OFFICER (DPO) CONTACT DETAILS

DPO Name: [DPO Name]

DPO Email: [DPO Email]

DPO Telephone: [DPO Phone]

The Data Protection Officer is the primary point of contact for the Information Commissioner's Office (ICO) and for affected individuals in relation to this breach notification.

3. BREACH TIMELINE

Date Breach Discovered: [Breach Discovery Date]

Date Breach Occurred (if known): [Breach Occurrence Date]

Under UK GDPR Article 33(1), the data controller is required to notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. Where notification is not made within 72 hours, the controller must provide reasons for the delay.

4. ICO NOTIFICATION STATUS

Breach Reported to ICO: [Reported To Ico]

5. NATURE OF THE BREACH

Type of Breach: [Breach Type]

Description of the Breach:

[Breach Description]

Personal data breach types are defined under UK GDPR Article 4(12) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

6. CATEGORIES OF PERSONAL DATA AFFECTED

The following categories of personal data were involved in this breach:

[Data Categories]

Where any of the above categories constitute special category personal data under UK GDPR Article 9 (health data, biometric data, criminal conviction data, or data concerning children), the risk to affected individuals is assessed as elevated, and enhanced remediation measures have been applied accordingly.

7. SCALE OF THE BREACH

Approximate number of records affected: [Number of Records]

Approximate number of individuals affected: [Number of Individuals]

These figures are based on information available at the date of this notification. As the investigation continues, these numbers may be revised and any material revision will be communicated to the ICO.

8. LIKELY CONSEQUENCES OF THE BREACH

[Likely Consequences]

This risk assessment has been conducted in accordance with ICO guidance on assessing the risk of a personal data breach, taking into account the type of breach, the nature of the data, the number of individuals affected, and the ease of identification of affected individuals.

9. MEASURES TAKEN TO ADDRESS THE BREACH

Immediate Containment Measures:

[Measures Taken]

Measures to Mitigate Effects on Individuals:

[Measures to Mitigate]

10. NOTIFICATION TO DATA SUBJECTS

Data subjects notified: [Data Subjects Notified]

11. CROSS-BORDER CONSIDERATIONS

Cross-border transfer involved: [Cross Border Involved]

12. RISK ASSESSMENT SUMMARY

In accordance with ICO guidance on personal data breach management, the following risk assessment has been conducted to determine whether notification to the ICO under Article 33 and to data subjects under Article 34 is required:

Confidentiality: whether personal data has been accessed by or disclosed to unauthorised parties;
Integrity: whether personal data has been altered without authorisation;
Availability: whether personal data has been rendered inaccessible to authorised users;
Sensitivity of the data: whether special category data or data relating to vulnerable individuals is involved;
Volume of data: the number of records and individuals affected;
Ease of identification: whether affected individuals can be identified from the breached data; and
Likely real-world impact: including financial loss, identity theft, discrimination, physical harm, or damage to reputation.

13. ACTION PLAN AND ONGOING INVESTIGATION

The organisation is committed to conducting a thorough internal investigation into the circumstances of this breach. The following ongoing actions are being taken:

A full forensic review of affected systems to determine the root cause and scope of the breach;
An audit of access controls and security configurations to prevent recurrence;
A review and update of data breach response procedures in accordance with ICO guidance and UK GDPR obligations;
Staff training and awareness updates regarding data breach prevention and reporting obligations; and
Documentation of the breach and all response actions in the organisation's Records of Processing Activities (ROPA) as required by UK GDPR Article 30.

The organisation will provide the ICO with any additional information requested and will promptly notify the ICO of any material developments in the investigation, including any changes to the estimated number of affected individuals or the categories of data involved.

14. APPLICABLE LEGISLATION

UK General Data Protection Regulation (UK GDPR) — Articles 33 (notification to supervisory authority), 34 (communication to data subject), 4(12) (definition of personal data breach), 5(1)(f) (integrity and confidentiality principle), 32 (security of processing), and Article 82 (liability);
Data Protection Act 2018, s.108 (notification of breach — processor obligation) and Part 3 (law enforcement processing);
Network and Information Systems (NIS) Regulations 2018 — additional obligations for operators of essential services and relevant digital service providers; and
ICO Guidance on Personal Data Breaches (updated 2024) — practical guidance on breach assessment, notification thresholds, and documentation requirements.

15. DECLARATION

I, [Reporter Name], [Reporter Position] of [Organisation Name], confirm that the information provided in this Data Breach Notification Form is accurate and complete to the best of my knowledge and belief at the date of this report. I understand that the organisation has a continuing obligation to update the ICO if further information becomes available that materially affects the contents of this notification.

Date of This Report: [Report Date]

Reporter

[Reporter Name]

Signature

Date: ________________

Maintained by Vladislav Sergienko, Founder·Template last modified: 2026-06-23·Report an error

What Is a GDPR Data Breach Notification Form (England & Wales)?

A GDPR Data Breach Notification Form in the United Kingdom notifies the regulator or affected individuals of a personal-data breach and records the facts, risks, and remedial steps taken, with its requirements set by UK General Data Protection Regulation (UK GDPR).

A personal data breach is defined in Article 4(12) of the UK GDPR as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed. Breaches may be categorised as confidentiality breaches (unauthorised disclosure or access), integrity breaches (unauthorised alteration of data), or availability breaches (loss of access or destruction of data). In practice, a single incident may involve elements of all three.

The ICO is the UK's independent supervisory authority for data protection, established under Section 114 of the Data Protection Act 2018. The ICO has extensive enforcement powers, including the ability to impose administrative fines of up to £17.5 million or 4% of global annual turnover for the most serious UK GDPR infringements. The ICO takes a proportionate approach to enforcement and has consistently emphasised that prompt, transparent reporting of breaches is viewed favourably, while delayed or concealed notifications attract more severe regulatory action.

The United Kingdom GDPR Data Breach Notification Form (England & Wales) notification template is designed to help data controllers comply with the mandatory content requirements of Article 33(3), document breaches in accordance with Article 33(5), and assess whether communication to data subjects is required under Article 34. It covers all relevant legislation including the Network and Information Systems (NIS) Regulations 2018 for operators of essential services and relevant digital service providers.

The legal framework governing the GDPR Data Breach Notification Form (England & Wales) in United Kingdom draws on several key statutes and regulatory bodies. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Parties executing a GDPR Data Breach Notification Form (England & Wales) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The UK General Data Protection Regulation (UK GDPR) sets the foundational requirements.

When Do You Need a GDPR Data Breach Notification Form (England & Wales)?

A Data Breach Notification Form is needed whenever a data controller becomes aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons. The risk threshold for ICO notification under Article 33 is lower than the high-risk threshold that triggers individual notification under Article 34, meaning that many breaches require ICO notification but not individual communication.

You need to complete a Data Breach Notification when your organisation experiences an unauthorised access incident, such as a cyber attack, hacking attempt, or ransomware infection that compromises personal data. Modern ransomware attacks typically constitute availability breaches (data encrypted and inaccessible) as well as confidentiality breaches (data exfiltrated prior to encryption), and both aspects must be addressed in the notification.

A notification is also required when an employee accidently sends an email containing personal data to the wrong recipient, discloses a password to an unauthorised person, or loses a device (laptop, USB drive, mobile phone) containing unencrypted personal data. Human error is one of the most common causes of personal data breaches reported to the ICO, and even inadvertent disclosures must be assessed against the notification threshold.

Where a third-party processor (cloud provider, outsourced IT support, payroll bureau) experiences a breach affecting your organisation's personal data, the processor must notify the controller without undue delay under Article 33(2) and Section 108 of the Data Protection Act 2018. The controller is then responsible for assessing whether the breach requires ICO notification within the 72-hour window.

Every breach, including those that fall below the ICO notification threshold, must be documented in the organisation's internal breach register under Article 33(5). This notification form can serve as the basis for that internal documentation. Healthcare providers, financial services firms, telecoms operators, and other regulated organisations may have additional sector-specific breach reporting obligations imposed by their sector regulator alongside UK GDPR obligations.

What to Include in Your GDPR Data Breach Notification Form (England & Wales)

Organisation and DPO Identification — The notification must clearly identify the data controller by full legal name, registered address, and ICO registration number. The Data Protection Officer's (DPO) contact details must be provided, as the ICO will direct further enquiries to the DPO. Under UK GDPR Article 37, organisations that process special category data on a large scale, conduct large-scale systematic monitoring, or are public authorities must appoint a DPO. Even organisations that are not required to appoint a DPO should designate a named individual responsible for data protection and breach management.

Breach Timeline — The exact date and time of breach discovery must be recorded, as this marks the start of the 72-hour notification window under Article 33(1). The date of occurrence (when the breach actually happened, which may be different from the date of discovery) should also be stated, along with an explanation if there is a significant gap between occurrence and discovery. The ICO requires organisations to explain any delay in notifying beyond the 72-hour deadline.

ICO Notification Status — The form records whether the ICO has been notified and, if so, the ICO reference number assigned. Where notification has been made within 72 hours, this should be confirmed. Where notification is delayed, reasons must be documented. The ICO's online breach notification tool at ico.org.uk allows initial reports to be submitted with limited information, with additional details to follow.

Breach Classification — The type of breach (confidentiality, integrity, availability, or a combination) must be identified in accordance with the UK GDPR Article 4(12) definition. The breach description should provide a clear factual account of what happened, how it was discovered, the systems and data affected, and the likely cause. Factual accuracy is critical — ICO investigations have highlighted cases where inaccurate breach notifications have led to increased regulatory scrutiny.

Categories and Volume of Data — Article 33(3)(a) requires identification of the categories of personal data affected and the approximate number of records and data subjects involved. Special category data (health, biometric, criminal, children's data) attracts heightened risk assessment and may automatically trigger the high-risk threshold for individual notification under Article 34.

Likely Consequences and Risk Assessment — The notification must describe the likely consequences of the breach for affected individuals. The ICO expects a structured risk assessment considering: the type of data involved, the number of individuals affected, the likelihood that harm will materialise, and the severity of that harm. The four key harms the ICO considers are: physical harm, material harm (financial loss, identity fraud), non-material harm (distress, damage to reputation), and loss of control over personal data.

Remediation Measures — The controller must describe both the immediate containment steps taken (isolating affected systems, revoking compromised credentials, patching vulnerabilities) and the longer-term measures to prevent recurrence and mitigate harm to individuals (offering credit monitoring, resetting passwords, notifying individuals to be vigilant against phishing).

Individual Notification — Where the breach presents a high risk to individuals, Article 34 requires direct communication to those individuals without undue delay. The notification must be in clear and plain language and include: the DPO's contact details, the likely consequences, and the measures taken. The method of communication (individual email, letter, SMS, or public announcement) must be appropriate to reach affected individuals effectively.

Cross-Border and NIS Considerations — Where data relating to individuals in other jurisdictions is affected, or where the organisation is an operator of essential services or relevant digital service provider under the NIS Regulations 2018, additional notification obligations to other supervisory authorities may arise. This section of the notification form documents all regulatory notifications made.

Declaration and Signature — The form must be signed by an authorised representative (typically the DPO or senior management) confirming the accuracy of the information and the organisation's ongoing commitment to provide updated information as the investigation proceeds. The forms-legal.com GDPR Data Breach Notification Form (England & Wales) template covers the mandatory elements under UK General Data Protection Regulation (UK GDPR).

Sources & Citations

Statutory citations link to official government sources.

GDPR Article 37EU – GDPR
GDPR Article 4EU – GDPR

Cite this page

Reference this free template in an article, syllabus, or research note:

APA

Forms Legal. (2026). GDPR Data Breach Notification Form (England & Wales) (United Kingdom) [Legal document template]. Forms Legal. https://forms-legal.com/uk/business/policies/gdpr-data-breach-notification-england-wales

MLA

"GDPR Data Breach Notification Form (England & Wales) (United Kingdom)." Forms Legal, 2026, https://forms-legal.com/uk/business/policies/gdpr-data-breach-notification-england-wales.

BibTeX

@misc{formslegal-gdpr-data-breach-notification-england-wales,
  author       = {{Forms Legal}},
  title        = {GDPR Data Breach Notification Form (England & Wales) (United Kingdom)},
  year         = {2026},
  howpublished = {\url{https://forms-legal.com/uk/business/policies/gdpr-data-breach-notification-england-wales}},
  note         = {Free legal document template. Based on UK General Data Protection Regulation (UK GDPR)}
}

Frequently Asked Questions

Based on UK General Data Protection Regulation (UK GDPR) — Template last modified June 2026

This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer

Found an error? Let us know