Data Breach Response Procedure Template for UK Businesses
Under UK GDPR, you have 72 hours to report a serious data breach to the ICO. Without a written procedure, you risk missing the deadline — which can result in additional fines on top of any penalty for the breach itself.
Instant PDF & Word download · 14-day money-back guarantee
What is a data breach response procedure?
A data breach response procedure is a document that sets out exactly what your business does when a personal data breach occurs. It defines who is responsible for managing breaches, how they are assessed, whether they need to be reported to the ICO, and whether affected individuals need to be notified.
Without a written procedure, most businesses either panic and report everything (wasting ICO resources) or fail to report notifiable breaches in time. A clear procedure removes the guesswork and ensures you meet your 72-hour reporting obligation every time.
What your data breach procedure should cover
- How to identify and contain a breach as quickly as possible
- Who is responsible for managing the breach response
- How to assess the risk level and decide whether ICO notification is required
- The 72-hour notification process for reporting to the ICO
- When and how to notify affected individuals
- Internal breach log requirements (all breaches must be documented)
- Post-breach review to prevent recurrence