Assess a personal data breach and the 72-hour notification to the ICO
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- Build the breach timeline from the incident records: when the controller became aware, what data and how many people were affected, and the 72-hour clock.
- What the lawyer must review
- Decide whether the breach must be notified and whether affected individuals must be told. Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware (UK GDPR art 33(1)). Follow the ICO's 'report early, update later' approach (guidance updated 28 May 2025).
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Do not begin AI assistance until the responsible lawyer has defined and confirmed its permitted scope. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option | Notice | AI use Yellow | Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts, plus the decision record for choosing direct, at-risk or public notification. |
Signed-in accounts can read the full text of each one. All precedents.