Data breaches: who decides whether to report?

Key takeaways

Who decides to report a data breach? The data controller, which is your business, not your provider. Where a breach is likely to risk people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware, and tell affected people if the risk is high. Your processor must tell you without undue delay.

• The controller decides; the processor alerts and helps.
• Report risky breaches to the ICO within 72 hours.
• Tell affected people without undue delay if risk is high.
• Log every breach, reported or not.

Why must the decision stay with you?

Because the duty to report sits with the controller, and the decision weighs legal risk, customer trust and what to say publicly. A provider may understate a breach it caused, or overreact. A named person in your business, with advice, should judge the risk and decide.

• Which business processes should you never outsource?
• Data controller duties you cannot outsource

What should happen in the first 72 hours?

The clock starts when you become aware, which can include when your processor tells you.

• Contain the breach and secure systems.
• Establish what data, how many people and what risk.
• Decide whether to report to the ICO.
• Decide whether to tell affected individuals.
• Record the facts, decision and reasons.

• Crisis spokesperson: who speaks for the business?
• BPO business continuity: planning for disruption

What should your processor contract require?

Notification to you without undue delay, with the details you need to assess risk, plus help with containment, investigation and any notifications. Agree a target, such as within 24 hours of the provider becoming aware, so your 72 hours are not used up waiting.

• Contract clauses that keep control with you
• BPO data security: protecting data with outsourced teams

When does a breach not need reporting?

When it is unlikely to result in a risk to individuals, for example a misdirected email containing no sensitive data that is promptly deleted. You must still log it and record why you decided not to report. The ICO's self-assessment tool helps with the judgement.

• Processes with sensitive data: can they be outsourced?

What does this look like in practice?

A pattern we see: a provider mentions a 'minor incident' in a monthly report, weeks after it happened. Contracts with a 24-hour notification rule and a named internal decision-maker keep reporting within the legal window.

• See client work
• BPO Solutions for UK businesses

Breach decision checklist

• Name a breach decision-maker and deputy.
• Require providers to notify within 24 hours.
• Use the ICO self-assessment to judge risk.
• Report within 72 hours where required.
• Log every breach and decision.

• Data controller duties you cannot outsource
• Software subscriptions: own the account, share the access

Next step

Check your main provider contracts for a breach notification time. If none is stated, agree one this month.