You've Discovered a Data Breach - Here's Your Action Plan

First 24 Hours:

1. Contain the breach - Stop it getting worse. This might mean taking systems offline, revoking access, or retrieving sent emails. Don't destroy evidence, but stop the bleeding.

1. Assess what happened - What data was involved? How many people affected? How did it happen? Get facts, not speculation.

1. Determine if ICO notification is needed - Under UK GDPR, you must report to the Information Commissioner's Office (ICO) within 72 hours IF the breach is likely to result in a risk to people's rights and freedoms. Not all breaches need reporting - an email with names sent to the wrong person is different from thousands of financial records being stolen.

When You Must Report to the ICO:
- The data could be used for identity theft or fraud
- Large numbers of people are affected
- Sensitive data categories involved (health, financial, etc.)
- The data wasn't encrypted or protected
- People might suffer significant harm

When You Might Not Need to Report:
- Very minor, contained breaches
- Data was encrypted and keys weren't compromised
- You can demonstrate no real risk of harm

Telling Affected Individuals:
If the breach is likely to result in high risk to individuals, you must also tell them. This isn't about protecting yourself legally - it's about giving people the chance to protect themselves (change passwords, watch for fraud, etc.).

After the Immediate Crisis:
- Document everything for your records
- Conduct a proper investigation into root causes
- Implement changes to prevent recurrence
- Consider whether any disciplinary or legal action is needed
- Review your data protection practices more broadly