When a company loses control of personal data, the clock starts quickly. Under the UK and EU GDPR, the GDPR data breach 72-hour rules set a firm deadline for telling regulators what happened. For the people whose data was exposed, those rules matter too, because they shape what you hear, when you hear it, and what you should do next.
This guide explains the process in plain language, from the company's side and from yours.
When the 72-hour clock starts
The 72-hour window is built around a single idea: awareness. Under Article 33 of the GDPR, a data controller must report a personal data breach to the relevant supervisory authority within 72 hours of becoming aware of it. In the UK, that authority is the Information Commissioner's Office (ICO). In the EU, it is the data protection authority of the relevant member state.
Two points often cause confusion:
- The clock starts at awareness, not at the attack. A breach may have happened days or weeks earlier. The deadline runs from when the organisation has a reasonable degree of certainty that personal data was compromised.
- The deadline is not a pause for investigation. Organisations are expected to act quickly. Where full details are not yet available, the usual approach is to report what is known and provide further information in stages.
Missing the deadline without a reasonable justification can itself be a breach of Article 33, which exposes the controller to enforcement action, according to legal commentary on the rule.
A practical note: the 72 hours include weekends and public holidays. Breaches do not wait for office hours, so a tested incident-response plan matters more than a good intention.
What companies must tell the ICO and affected people
Notifying the regulator and notifying individuals are two separate duties with different triggers.
Telling the ICO. A report is generally required unless the breach is unlikely to result in a risk to people's rights and freedoms. The notification should describe the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences, and the measures taken or proposed to deal with it. It should also include contact details for the organisation's data protection contact.
Telling individuals. When a breach is likely to result in a high risk to people, the organisation must also tell those affected without undue delay. That message should be written in clear language and explain what happened, what the likely consequences are, and what steps people can take to protect themselves.
The bar for contacting individuals is higher than the bar for contacting the regulator. Stolen passport scans, health records, or financial details tend to sit comfortably above it. Cases such as the Deadlock ransomware leak of LT Group passport data show how identity documents can end up in the hands of criminals, which is exactly the sort of exposure that points to high risk.
Organisations are also expected to keep an internal record of every breach, including ones they decide not to report, along with the reasoning.
What you should do if your data is exposed
A breach notice can feel abstract. Here is a concrete checklist you can work through the same day.
- Change the affected password and any reused ones. If the same password protects other accounts, change those too. Use a unique password for each service, ideally stored in a password manager.
- Turn on multi-factor authentication. Prefer an authenticator app or a hardware key over text messages where possible.
- Read the notice carefully. Note which data types were involved: contact details, identity documents, health or financial information. This tells you which risks to prioritise.
- Watch your accounts. Check bank and card statements and consider a credit monitoring service if financial data or identity documents were involved.
- Be sceptical of unexpected contact. Emails, texts, or calls that reference the breach may be genuine, or they may be scams that use it as a hook.
- Make a subject access request. Under the UK and EU GDPR you can ask an organisation what personal data it holds about you, and in many cases how it is being used. This helps you understand your real exposure and creates a paper trail.
- Know your complaint route. If you feel the company handled the incident badly, you can raise it with the ICO in the UK or your national data protection authority in the EU.
Why stolen data fuels follow-on scams
The initial breach is often only the first stage. Stolen data has resale and extortion value, and attackers increasingly use it to pressure individuals directly.
Coverage of the AnMed ransomware attack and patient extortion scam shows how this works: reports suggested attackers may have used stolen patient data to run personalised extortion attempts against the people it belonged to. Personal details make a threat feel credible, which is why these messages can be so effective.
Leaks can also be public. In the case of ShinyHunters leaking 8.8TB of stolen One Medical data, data was published after extortion pressure, meaning anyone could potentially access it. Once information is out, it can be used for phishing, impersonation, and targeted fraud long after the original incident is forgotten.
This is why prompt notification matters. The sooner people know, the sooner they can lock down accounts and recognise a scam for what it is. Small organisations are not exempt either, as the Jaipur ransomware case illustrates: ransomware does not discriminate by company size, and a team without dedicated security staff still needs a response plan.
What This Means For You
The law gives you a reasonable expectation that a company will tell the regulator within 72 hours of becoming aware of a breach, and tell you directly if the risk to you is high. It does not guarantee your data stays safe, and it cannot undo a leak. Your own response is what limits the damage.
If you run a business, treat 72 hours as a planning constraint: know who decides whether a breach is reportable, who contacts the ICO, and how you would reach affected customers quickly.
Key takeaways
- The 72-hour period starts when an organisation becomes aware of a breach, not when it began.
- The ICO or EU authority must be told unless the risk to people is unlikely; individuals must be told when risk is high.
- Change passwords, enable multi-factor authentication, and monitor your accounts as soon as you receive a notice.
- Treat any message that mentions a breach with caution, since criminals reuse stolen data for extortion and phishing.
- Use your right to request your data to see what an organisation holds.
Understanding the GDPR data breach 72-hour rules helps you judge whether a company is acting properly, but your best protection is acting quickly yourself. Secure your accounts today, stay alert for follow-on scams, and read the AnMed and ShinyHunters coverage above to see how breached data gets misused in practice.
