Last updated: 5 September 2026
TL;DR: A notifiable data breach must be reported to the ICO without undue delay and not later than 72 hours after you become aware of it. You report when the breach is likely to risk people’s rights and freedoms, you tell affected individuals directly where the risk is high, and you must keep an internal record of every breach whether or not it is reported.
It usually starts with something small. A rota emailed to the wrong address. A laptop left in a car. A reference request answered with the whole personnel file attached. None of those feel like an incident on the day, and the clock has already started on all three.
More than a hack. A personal data breach is a security incident affecting the confidentiality, integrity or availability of personal data, which covers accidental disclosure, loss and destruction as well as deliberate attacks.
That third word matters. Losing access to data counts too, so a ransomware incident that locks your practice management system, or a backup that turns out to be empty, is a breach even if nothing left the building.
It applies to staff data as much as client data. Practices tend to think first about client records, but a personnel file, a sickness record or a payroll report is special category or otherwise sensitive information about an identifiable person.
Human error causes most of them. The ICO’s guidance covers the full framework in personal data breaches: a guide, and the practical lesson is that your risk sits in daily habits rather than in your firewall.
Ordinary, and usually caused by someone doing their job in a hurry. Recognising the everyday versions is what turns a policy into something people actually use.
The leaver one is the most common in small practices, and the least noticed. A nurse who left in March and still has access to the rota system and the shared drive in September is a standing risk that nobody has looked at.
Consolidated systems help because permissions can be reviewed in one place, which is part of the argument in our guide to digital staff records.
When the breach is likely to result in a risk to people’s rights and freedoms. In that case the ICO requires you to report without undue delay and not later than 72 hours after becoming aware of it.
Risk of harm means any potential harm or detriment, including safeguarding issues, identity theft or significant distress. Applied to staff data, disclosing someone’s mental health absence to colleagues is capable of causing exactly that.
The 72 hours runs from awareness, not from the incident. If a rota went to the wrong address on a Friday and you learn on Monday, the clock starts Monday, and it does not pause for weekends.
Where you decide not to report, record the reasoning. The ICO requires a record of any personal data breach regardless of whether you were required to notify, including what happened, the effects and the remedial action taken.
Contain, assess, record, then decide on reporting, in that order. The instinct to work out who is to blame comes later, and doing it first costs you the hours you needed.
Do not delay a report because the investigation is incomplete. The ICO expects notification within 72 hours where feasible, and you can provide further detail afterwards rather than waiting until you know everything.
Practise the sequence once. A ten minute tabletop exercise using a realistic scenario, such as a payroll report sent to an external address, tells you within minutes whether anyone knows who to call on a Saturday, which is exactly when these things surface.
Name the person who owns this before you need them. In a practice that is usually the practice manager, with a partner as deputy, and the whole team should know which name to say it to.
Where the breach is likely to result in a high risk to their rights and freedoms, you must inform them directly and without undue delay. High risk is a higher bar than the one for reporting to the ICO.
Assess both severity and likelihood. A payroll file sent to an external address is severe and probable; an internal email seen by one colleague who deleted it immediately is neither, though it still goes in the record.
Tell people plainly and quickly when you do tell them. What happened, what data, what you have done, what they should watch for, and who to contact. Staff forgive the incident far more readily than the discovery that you knew for a fortnight.
Expect a follow-up request for their file. A data breach frequently produces a subject access request from the person concerned, and being ready for that is part of handling the first event well.
No breach log and no named owner? A free 30-minute HR health check will get both in place. Book your HR health check.
By fixing the six habits that cause most of them. Practices reach for technology first, and the cheaper wins are almost entirely about process and access.
Point six changes the numbers most. A practice where staff report near misses catches errors in the hour rather than in the month, and near miss reporting is a habit our See It Report It system is designed to build.
Watch personal devices in particular. Staff photograph rotas, forward records to personal email to work at home and keep client details in their own phones, all with good intentions, and each of those habits puts practice data somewhere you cannot reach it after they leave.
Build the offboarding step into your leaver checklist so access removal is not a memory task. Our guide to GDPR and staff records covers the wider retention and security picture.
Where the breach is notifiable, the ICO requires a report without undue delay and not later than 72 hours after you become aware of it. The clock starts from awareness rather than from the incident, and it does not stop for weekends or bank holidays.
No. You report where the breach is likely to result in a risk to people’s rights and freedoms. You must, however, keep a record of every personal data breach regardless of whether it was reportable, including what happened, the effects and the remedial action taken.
Yes, if it contained personal data. Whether it is reportable depends on the risk: a rota with home addresses sent externally is very different from an internal message seen by one colleague. Assess it, record it, and report if a risk to people is likely.
Report anyway if a risk is likely. The ICO expects notification within 72 hours where feasible and accepts that information can follow in phases. Waiting until the investigation is complete is the most common way practices miss the deadline.
Yes. The obligations attach to personal data about identifiable people, and employee records often contain health information, bank details and home addresses. In practice, staff data incidents are frequently more sensitive than the client records people worry about.
The practices that handle a data breach well are not the ones with the best software. They are the ones where somebody knew immediately who to tell, the time of awareness got written down, and the containment happened before the blame conversation.
Name an owner, keep a breach log, review access quarterly and remove leaver access on the last day. Our policy library and HR consultancy cover the people side of all of it, and the free HR health check is where to start.
The Vet HR Team provides HR consultancy and white-labelled staff systems exclusively to UK veterinary practices. Check current ICO guidance, and take specialist advice on a serious incident.
Contracts, rotas, holiday, a difficult conversation. Tell us what you are dealing with and we will come back within one working day. Nothing to sign up to.
Got it. We will come back to you within one working day. If you do not see a reply, please check your spam folder.
