When must I notify a personal data breach? #GDPR

Any personal data breach must be notified to the Information Commissioners Office (ICO) within 72 hours of the data controller having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

 If the breach is reported later, the reason for the delay must be explained at the same time the breach is notified late.

View our GDPR page for more information