A data breach is not always a reportable event, but the pressure to decide can feel immense when the clock is ticking. For most UK SMEs, the realization that data has gone missing, been accessed by an unauthorized person, or been encrypted by ransomware triggers an immediate panic about the Information Commissioner's Office (ICO). However, the UK General Data Protection Regulation (UK GDPR) does not require you to report every single slip-up. It requires a measured assessment of risk.
Knowing when to pick up the phone (or fill out the online form) and when to simply log the incident internally is the difference between a controlled response and an unnecessary regulatory headache. The decision rests on whether the breach is likely to result in a risk to the rights and freedoms of the individuals involved. If that risk is unlikely, you do not report it. If it is likely, you have 72 hours from the moment you become aware of it.
What a personal data breach actually means
In plain English, a personal data breach is a security incident that affects the confidentiality, integrity, or availability of personal data. It is a common misconception that a breach only occurs when data is stolen by a hacker. If an employee accidentally deletes a folder of client files and there is no backup, that is a breach of availability. If a staff member sends a spreadsheet of payroll data to the wrong recipient, that is a breach of confidentiality. If a malicious actor gains access to your CRM and changes bank details for suppliers, that is a breach of integrity.
Personal data is any information relating to an identifiable living person. For a typical SME, this includes customer names, email addresses, HR records, financial details, and even IP addresses. The breach occurs when this data is lost, destroyed, altered, or disclosed without authority. The moment you realize one of these things has happened, the 72-hour reporting clock begins.
The risk threshold for reporting
Under UK GDPR, the trigger for reporting to the ICO is the likelihood of risk to individuals. You are not reporting because you made a mistake; you are reporting because that mistake might cause harm to the people whose data you hold. Harm can be physical, material, or non-material. Examples include identity theft, financial loss, damage to reputation, or loss of confidentiality.
We categorize these into three levels of risk. First, where no risk is likely (e.g., an encrypted laptop is stolen and the keys are secure), no report to the ICO is required. Second, where a risk is likely, you must report to the ICO within 72 hours. Third, where a high risk is likely (e.g., medical records or passwords have been leaked), you must also notify the affected individuals without undue delay.
A pattern we see on most tenants we take on is that the assessment of risk is often hindered by a lack of logging. If you cannot prove what the intruder did, you have to assume the worst case scenario. This often forces a report to the ICO that might have been avoided if the evidence was available to prove no data was exfiltrated.
Using Microsoft 365 to gather evidence
If your business runs on Microsoft 365, your primary source of truth during the first 72 hours will be the Microsoft Purview compliance portal and Entra ID (formerly Azure AD). This is where you find the evidence needed to decide if a breach is reportable.
You should immediately look at the Unified Audit Log (UAL). This records activities such as file downloads, email forwarding rule creation, and mailbox logins. For example, if a staff member's account was compromised, the UAL will show you if the attacker actually opened any sensitive files or if they merely sent spam. If the logs show they only sent 500 emails about Ray-Ban sunglasses and didn't touch the 'Finance' folder, your risk assessment changes significantly.
You also need to check sign-in logs in Entra ID. Look for 'Impossible Travel' alerts, which show a login from a foreign IP address minutes after a legitimate UK login. If you have managed cyber security services, your provider should be able to pull these logs and interpret them for you quickly. Note that basic Microsoft 365 licenses often only keep these logs for 30 to 90 days. If you discover a breach that happened four months ago, the evidence may already be gone, making the ICO report much more difficult to navigate.
The 72-hour reporting window
The law says you must report a breach within 72 hours of becoming aware of it. 'Becoming aware' is a specific legal point. It is not the moment the breach actually happened; it is the moment you have a reasonable degree of certainty that a security incident has occurred that has affected personal data.
If you discover an anomaly on a Friday afternoon at 4:00 PM, the clock does not stop for the weekend. The ICO expects a report by Monday afternoon. If you do not have all the facts by then, you should still submit a 'phase one' report. You can tell the ICO that the investigation is ongoing and you will provide more details as they emerge. Being late with a report is often viewed more harshly than providing an incomplete report on time.
What to record if you do not report
Even if you conclude that a breach is not reportable because the risk is unlikely, your work is not finished. Article 33(5) of the UK GDPR requires you to maintain an internal breach register. This is a log of every security incident, regardless of its severity.
For each incident, you must record the facts, the effects, and the remedial action taken. Crucially, you must document the reasoning behind your decision not to report. If the ICO ever audits your business, they will ask to see this register. If you have a major breach in the future, they will look back at your history of minor incidents to see if there was a pattern of negligence. A well-maintained register proves that you take your obligations seriously and that you are actively monitoring your cyber security.
The financial cost of getting it wrong
To understand the commercial impact, consider a hypothetical 25-person professional services firm. If they suffer a breach where a staff member's email is hijacked and client contact details are stolen, the costs spiral quickly.
First, there is the immediate technical cost. An engineer might spend 10 to 15 hours forensicallly analyzing logs to determine the extent of the breach. At a typical UK rate of £120 per hour, that is £1,800. Then there is the management time. The directors will likely spend two full days dealing with the fallout, assessing risk, and communicating with staff. If those directors bill out at £150 per hour, that is another £2,400 in lost productivity. If they decide they must report to the ICO and notify 500 clients, the reputational damage and potential for lost contracts can easily reach five figures. This is why having a proactive managed IT support partner is vital; they can often prevent the breach from occurring in the first place through proper MFA and conditional access policies.
Common mistakes we see in breach response
- Delaying for the 'perfect' answer: Many businesses wait until they know exactly what happened before telling anyone. This usually results in missing the 72-hour window.
- Deleting the evidence: In a rush to 'fix' the problem, IT staff sometimes wipe a compromised laptop or reset a mailbox without exporting the logs first. This makes a risk assessment impossible.
- Over-reporting: Some firms report every single 'wrong email' to the ICO out of fear. This creates unnecessary work and puts your business on the regulator's radar for trivial matters.
- Ignoring the 'availability' aspect: We often see businesses forget that a permanent loss of data (like a failed server with no Microsoft 365 backup) is a reportable breach if it impacts people's lives.
Data breach reporting FAQ
Do I have to report a breach if the data was encrypted?
If the data was encrypted with a high level of security (like AES-256) and the keys were not compromised, the ICO generally considers this 'no risk' as the data is unintelligible to the thief. You must still log this in your internal breach register, but a report to the ICO is usually not required.
What happens if I miss the 72-hour deadline?
You must provide a reasoned justification for the delay when you eventually report. The ICO may be more lenient if the delay was caused by a complex technical investigation, but 'we were busy' or 'it was the weekend' are not acceptable excuses for a professional organisation.
Do I have to tell my customers about a breach?
You only have to tell individuals if the breach is likely to result in a 'high risk' to their rights and freedoms. This usually means data that could lead to financial fraud, identity theft, or physical harm. If the risk is low, you are not legally required to tell them, though you might choose to for transparency.
Can the ICO fine my small business?
Yes, the ICO has the power to issue significant fines, but for SMEs, they often prefer to issue warnings, reprimands, or enforcement notices. Fines are usually reserved for businesses that show a deliberate disregard for data protection or fail to report major incidents they were clearly aware of.
How Black Sheep Support helps
Reporting a breach is easier when you have the data to back up your decisions. We help UK SMEs move from a reactive 'fingers crossed' approach to a proactive security posture where logs are kept, alerts are monitored, and risks are understood.
If you are worried about your current data protection setup or have suffered an incident and need help securing your environment
and we will help you identify the gaps in your Microsoft 365 security. We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is built for resilience.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers, or 15 to 20 minutes on your own, no commitment.
Want this handled for you? See Compliance and Cyber Essentials.
Based in Brighton or Hove? We are too: see IT support in Brighton.
Free, no sales call needed
Two free checks. Know where you stand.
Domain email check
Can someone send email pretending to be you? Is your real email landing in junk? Type your domain and find out in under a minute.
IT Health Check
A short set of questions that scores your security and business risk, and tells you what to fix first. 15 to 20 minutes on your own.
