---
title: "Assess a personal data breach and the 72-hour notification to the ICO"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/united-kingdom"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R3-UK"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["UK"]
last_reviewed: "2026-10-18"
---

# Assess a personal data breach and the 72-hour notification to the ICO

> Build the breach timeline from the incident records: when the controller became aware, what data and how many people were affected, and the 72-hour clock.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack/united-kingdom  
Last reviewed: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | Build the breach timeline from the incident records: when the controller became aware, what data and how many people were affected, and the 72-hour clock. |
| What the lawyer must review | Decide whether the breach must be notified and whether affected individuals must be told. Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware (UK GDPR art 33(1)). Follow the ICO's 'report early, update later' approach (guidance updated 28 May 2025). |
| Written for | United Kingdom (England and Wales) |
| Applies to | [Assess a suspected data breach and draft the notification pack](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-suspected-data-breach-and-draft-the-notification-pack.md) |

## Checking plan

- What the AI does: Build the breach timeline from the incident records: when the controller became aware, what data and how many people were affected, and the 72-hour clock.
- Basis: Checked against the linked sources on 18 October 2026. Confirm the current instrument before reliance.

## Notes

- A processor must notify the controller without undue delay (art 33(2)).
- Do not apply the Australian notifiable data breaches scheme or its 30-day assessment period.

## Sources

- [UK GDPR art 33: notification of a personal data breach to the Commissioner](https://www.legislation.gov.uk/eur/2016/679/article/33) (checked 2026-10-18)
- [ICO: UK GDPR data breach reporting (DPA 2018)](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) (checked 2026-10-18)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/eligible-data-breach-notification-to-individuals.md) | Notice | Yellow | Plain-language notice to individuals whose information was involved in an eligible data breach, carrying the four matters s 26WK(3) requires, practical steps to reduce harm and support contacts,… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*