Assess whether your data breach needs to be reported to the ICO
Under UK GDPR Article 33, personal data breaches that are likely to result in a risk to individuals must be reported to the Information Commissioner's Office (ICO) within 72 hours. Answer the questions below to assess severity and get a recommended action plan.
⚠️ This tool produces a risk assessment, not legal advice. Always involve your DPO and legal counsel for actual breach decisions.