UK GDPR gives you 72 hours from becoming aware of a personal data breach to notify the ICO — and much shorter windows to preserve forensic evidence. This playbook is the exact sequence GoaTech's incident response team runs for UK customers.
Hour 0-1: Contain and preserve
Isolate affected systems from the network without powering them down (RAM contains critical forensic evidence). Snapshot cloud instances. Rotate credentials that may have been exposed. Assemble the incident bridge with legal, DPO, security and comms.
Hour 1-24: Scope and classify
Determine whether personal data was accessed or exfiltrated, which data subjects and how many, the categories (special-category data raises severity), and whether the breach is likely to result in a risk to rights and freedoms — the ICO's notification threshold.
Hour 24-72: Notify
If notifiable, submit the ICO breach report via ico.org.uk. Include what you know; you can update later. Consider whether direct notification to data subjects is required (high risk) and whether ICO reporting triggers wider disclosure — payment card networks, insurers, contractual obligations.
Frequently asked questions
What triggers ICO notification under UK GDPR?
A personal data breach that is likely to result in a risk to the rights and freedoms of natural persons. If unsure, the ICO's guidance is to report — under-reporting attracts higher penalties than over-reporting.
When must I notify affected individuals?
When the breach is likely to result in a high risk to rights and freedoms — for example financial loss, identity theft, discrimination or reputational damage. The notification must be in clear, plain language and describe the likely consequences and mitigation steps.
What are the UK GDPR breach penalties?
Up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious violations. The ICO also issues reprimands and enforcement notices that can require operational changes.
Get a UK breach response runbook
Talk to the GoaTech team. We'll map your current position and show what a tailored UK-focused programme looks like.