Data breach response: your first 72 hours

I have been in server rooms at two in the morning when something has gone wrong. The first thing I tell every team is this: breathe, then follow the plan. Panic makes breaches worse. A plan makes them manageable.

Under the Data Protection Act, a data controller must report a breach to the Information Commissioner within 72 hours and notify the people affected. The clock starts when you become aware of the breach, not when you finish investigating. Here is how to use those hours well.

Hour 0 to 4: contain it

• Stop the leak. Disconnect affected machines from the network, disable compromised accounts and change passwords.
• Do not wipe anything. You will need logs and evidence to understand what happened.
• Call your incident lead and, if you have one, your data protection officer.
• Start a written log: who found it, when, what was seen, and every action taken since.

Hour 4 to 24: understand it

• What personal data was involved? Names and emails are serious. Health records, bank details or identity documents are more serious.
• How many people are affected, and who are they? Customers, staff, patients, students?
• Is it still happening? Could it spread to other systems or to partners?

Hour 24 to 72: report it

• Prepare your report to the Commissioner: what happened, what data, how many people, what you have done and what you will do next.
• If you do not have every answer yet, report what you know and follow up. Late and complete is worse than on time and honest.
• Notify the people affected in plain language, with practical steps they can take, such as changing passwords or watching their bank statements.

After the 72 hours: learn from it

Once the dust settles, hold a review. What let the breach happen? What slowed you down? Update your policies, fix the weak point, and train your team on what changed. Every breach handled well makes the next one less likely.

Get ready before it happens

Download our free Data Breach Response Flowchart and pin it where your team can see it. If you want a tested plan with notification templates and a practice drill, our Incident Response Planning service gets you ready before the clock ever starts.

This article is general guidance, not legal advice.