Personal-Data Breaches and ICO Notification

• Confidentiality: an attendance file sent to an unauthorised recipient.
• Integrity: unauthorised or accidental alteration of a learner’s record.
• Availability: loss of access to personal data through a security incident, such as ransomware or destruction of the only usable copy.

A blocked attack with no compromise is not automatically a personal data breach. Conversely, absence of evidence of stolen data does not rule out an availability breach. See the ICO breach guide and ransomware guidance.

The facts that will matter:

• The register lists 24 learners, with each one’s name, email address and attendance. It contains nothing about health or any other special category.
• It went to one person outside the organisation, whose identity is known.
• The file was an ordinary attachment, with no password.

Each of the next five steps explains what to do in general and then says what happens in this case.

In the example: Dev reports it to his manager at once, without waiting to see whether it matters. The manager emails Sam Hale asking him to delete the message without opening the attachment and to confirm that he has. Within the hour Sam replies: he had not opened it, he has deleted it and he has not forwarded it.

Record the facts and timing. Investigate promptly rather than waiting for a final forensic report or every consequence to be known before treating an established breach as one. The awareness point is fact-dependent; initial detection and awareness may coincide, but are not necessarily identical. The ICO explains awareness, timing and phased reports.

In the example: the sent-items folder shows exactly what was sent, to whom and when. It was personal data, and it reached someone not entitled to it. That is a personal data breach, and the organisation became aware of it at the moment Dev checked his sent items. The clock for any notification starts then, not when the investigation ends.

A basic record sent to a known trusted recipient who promptly confirms deletion may support a different assessment from a file containing health details exposed publicly. Neither example gives an automatic verdict: assess the evidence and uncertainty, including whether copies remain. General risk management helps structure judgement, but a matrix score cannot replace the thresholds in the law.

In the example: the manager weighs four things.

1. What was it? Names, email addresses and attendance. Not health or financial details.
2. Who received it? One identifiable person at a known supplier, with no reason to misuse it.
3. What has been done? He confirmed promptly, in writing, that it was deleted unopened.
4. What could happen to the learners? At worst, 24 people’s email addresses were briefly in one extra mailbox.

Her conclusion is that harm to the learners is unlikely. See the ICO risk-assessment guidance.

Internal reporting starts the response and enables assessment; staff should not wait to decide whether the ICO threshold is met. A processor must notify its controller without undue delay after becoming aware of a personal data breach. It does not have a general entitlement to wait 72 hours. The controller then addresses its own notification obligations.

ICO notification — Article 33: the controller must notify unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Where required, notify without undue delay and, where feasible, within 72 hours of awareness. This is not a routine waiting period. If late, explain the delay. If information is incomplete, provide it in phases without undue further delay rather than waiting for a complete investigation. Article 33 also requires breach records regardless of notification.

Affected individuals — Article 34: where a breach is likely to result in a high risk, communicate to those affected without undue delay, using clear language about the breach, contact point, likely consequences and protective measures. This threshold is distinct from ICO notification; it is not simply another 72-hour deadline. Article 34 provides qualifications:

Other legal or sector-specific duties can apply as well: the diagram covers the general UK GDPR assessment, not every reporting regime, and it does not replace an organisation’s own incident procedure or legal advice on a real case.

In the example: there are two separate decisions.

• Tell the ICO? The test is whether the breach is unlikely to result in a risk to the learners. The manager has concluded that it is, so no notification is required.
• Tell the learners? The test is a high risk. A breach that is unlikely to cause any risk is far below that, so the law does not require it. The organisation may still choose to tell them.

For the fictional error, review whether recipient checking, sharing defaults or training failed and assign improvements. Keep evidence proportionate and protected rather than reproducing the exposed file in every ticket. Security Documentation explains how records support accountability. Containment, fact-finding and assessment can overlap: do not let a neat diagram delay protective action or notification.

In the example: deciding not to notify does not mean doing nothing. The organisation records the breach: what was sent, to whom, when it was noticed, what Sam Hale confirmed, and the reasons for concluding that risk was unlikely. That record is required whether or not the ICO is told. It also asks why it happened, and switches on a prompt that asks for confirmation before an attachment goes to an outside address.

The result: a breach that was reported inside the organisation within minutes, contained within the hour, assessed, judged not to need notifying, and recorded with reasons.

Change one fact. Suppose the register also had a column of learners’ health conditions, and the email went to a mistyped address that nobody recognises and that does not answer.

• The information is now special category data, which could cause real harm or distress if it were misused.
• The recipient is unknown and there is no confirmation of deletion, so it must be assumed that the file may have been read.
• Risk to the learners is no longer unlikely. The ICO must be told, within 72 hours of the moment the organisation became aware, even though the investigation is unfinished.
• Health details in unknown hands is likely to be a high risk, so the learners must be told as well, without undue delay, and advised what to look out for.

The same mistake, by the same person, with a different outcome at every decision. What changed was the kind of information and what is known about where it went.