In today’s digital age, data security is paramount. Despite the best efforts, data breaches and incidents can happen. It is essential to have a robust process in place to deal with such incidents. This post follows on from our blog, Understanding the Difference Between Data Incidents and Data Breaches, and will discuss the steps to take when dealing with data incidents and breaches.

Read more: How to Deal with Data Incidents and Breaches

Internal Reporting

The first step when a data incident or breach occurs is to report it internally. The internal reporting process should be well-documented and communicated to all employees. The incident response team should be notified immediately. The team should consist of members from various departments, including IT, legal, and HR.

Once the incident response team has been notified, they should investigate the incident to determine the cause and scope of the breach. They should also take steps to mitigate the damage and prevent further breaches. The team should document their findings and actions taken for future reference.

Risk Assessing for a Breach

After the incident response team has completed their investigation, a risk assessment should be conducted. The risk assessment should determine the potential impact of the breach on individuals and the organisation. The assessment should consider the sensitivity of the data breached, the number of individuals affected, and the potential harm to those individuals.

The risk assessment should also consider the likelihood of harm occurring and the organisation’s ability to prevent or mitigate the harm. The risk assessment results should be used to determine whether the breach needs to be reported to the Information Commissioner’s Office (ICO).

If you are struggling to identify if it is a breach, check out the ICO self-assessment.

Reporting a Breach to ICO

Under the General Data Protection Regulation (GDPR), organisations must report certain types of data breaches to the ICO within 72 hours of becoming aware of the breach. The ICO defines a data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.”

Organisations should report a breach to the ICO if it is likely to result in a risk to the rights and freedoms of individuals. The ICO provides an online self-assessment tool to help organisations determine whether a breach needs to be reported.

When reporting a breach to the ICO, organisations should provide as much detail as possible about the breach, including the type of data involved, the number of individuals affected, and the steps taken to mitigate the damage. Organisations should also notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms.


Data incidents and breaches are a reality in today’s digital world. It is essential to have a robust process in place to deal with these incidents. The process should include internal reporting, risk assessing for a breach, and reporting a breach to the ICO when necessary. By following these steps, organisations can minimise the impact of a data breach and protect the rights and freedoms of individuals.

If you would like to know how we can help you, you can either check out our services page or book a free discovery call to see how we can support you further.

Try our quiz