What to Do in the First 72 Hours of a Data Breach

Most businesses discover a breach at the worst possible moment and in the worst possible way — from a customer, from their bank, or from a police force telling them their data is already for sale. What happens in the hours that follow determines the cost far more than the breach itself did. There is a legal clock, a contractual clock and a forensic bill, and they are three different things. This guide sets out what to do, in order, and who you actually have to tell. The companion to it is our guide to preventing a data breach in the first place.

What counts as a data breach?

Wider than most people assume. Under UK data protection law a personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Losing access to data counts — a ransomware attack that encrypts your customer records is a breach even if nothing was copied out. So is a laptop left on a train, an email sent to the wrong recipient list, and a paper file that has gone missing.

That breadth matters because businesses regularly misclassify incidents and therefore miss deadlines. One of the ICO's recent penalties against a small firm was made worse precisely because the firm did not treat loss of access as a breach and reported it 43 days after becoming aware of it.

The first hour: contain without destroying the evidence

The instinct to fix things immediately is the instinct to avoid. Wiping and rebuilding a compromised machine destroys the evidence needed to establish what actually happened — which you will need for your own report, possibly for a forensic investigation, and certainly for your insurer.

• Isolate affected systems from the network. Disconnect them, or take the internet connection down — but do not power them off, because switching off destroys evidence held in memory.
• Do not delete, reinstall or 'clean' anything, and leave quarantined malware where your anti-virus put it.
• Preserve logs immediately — firewall, system, security and access logs, plus screenshots of what you are seeing. Logs often rotate and overwrite within days.
• Change credentials for remote access and administrative accounts, and disable rather than delete the accounts you suspect, keeping a record of what they were.
• Write down a timeline as you go: when you noticed, how you were told, what you did and at what time. You will not reconstruct this reliably afterwards, and every subsequent conversation will depend on it.
• Decide who is running this. One named person making decisions beats five people acting in parallel.
• Take payment processing off any affected system — a standalone terminal will keep the business trading while you work.

Do you have to tell the ICO?

If the breach involves personal data and is likely to result in a risk to people's rights and freedoms, yes — without undue delay, and not later than 72 hours after becoming aware of it. If you take longer, you must explain why.

Three details are worth knowing before you need them. The clock starts when you discover the breach, not when it occurred — an attacker present for months does not buy you months. You are permitted to report in phases, and the ICO would rather have an early partial report than a late complete one, so an incomplete picture is not a reason to wait. And if you decide the breach is not notifiable, you must be able to justify that decision, which means documenting it.

Separately, and regardless of whether you report, you must keep an internal record of every personal data breach — the facts, the effects and the remedial action taken. That record is one of the first things asked for if the ICO does become involved.

Reporting is done through the ICO's online form, which takes around half an hour and cannot be saved and returned to, so gather your facts first. The ICO also runs a personal data breach advice line on 0303 123 1113 if you genuinely cannot tell whether an incident is reportable.

Do you have to tell the customers?

The threshold for telling individuals is higher than the threshold for telling the regulator. You must inform affected people directly, without undue delay, where the breach is likely to result in a high risk to their rights and freedoms — which a loss of payment card data, or of enough information to enable convincing fraud against them, generally will be.

The communication should say what happened in plain terms, what data was involved, what you are doing about it, what they should do, and how to contact you. Businesses often delay this out of embarrassment; it rarely helps. Customers who learn about a breach from their bank, or from the news, are considerably less forgiving than those who heard it from you first.

Who else needs to know?

This is where the legal duties and the contractual ones diverge, and it is worth being clear which is which. Our guide to how PCI DSS and GDPR fit together covers that distinction in more depth.

• Your acquirer — the bank or payment company that settles your card takings. This is contractual rather than statutory, and it is urgent: your merchant agreement will require prompt notification of any suspected compromise of card data, and your acquirer notifies the card schemes on your behalf.
• Report Fraud, the national fraud and cybercrime reporting service, which replaced Action Fraud in December 2025. Businesses in Scotland report to Police Scotland instead.
• The National Cyber Security Centre, where the breach was caused by a malicious actor. This is voluntary, and the ICO explicitly recommends it.
• Your insurer, immediately. Cyber policies typically require prompt notification, and late notice can invalidate cover — which is an expensive way to discover a clause.
• Your IT supplier or managed service provider, and any processor handling data on your behalf. If you are the one processing data for someone else, you must tell them without undue delay; the 72-hour duty is the controller's, not yours.
• The Financial Conduct Authority, if you are an FCA-authorised firm. Most merchants are not.

What is a forensic investigation going to cost?

This is the part that catches merchants out, and it has nothing to do with the ICO. Where a compromise of card data is confirmed or suspected, the card schemes can require an investigation by a PCI Forensic Investigator — an independent firm from an approved list — and the cost falls on the merchant. For a small business this can comfortably exceed any regulatory fine, and it arrives alongside remediation costs, potential scheme assessments and the cost of the fraud itself.

It is also the strongest practical argument for getting compliance right beforehand. A merchant who can demonstrate they were compliant at the time of a breach is in a materially better position with their acquirer than one who cannot. Our guide to PCI non-compliance fines and consequences sets out how those costs stack up.

What does the regulator look at afterwards?

Recent UK enforcement has been strikingly consistent about what it finds. Multi-factor authentication missing from an account somebody had forgotten about. Administrative accounts with far more privilege than the job required. Alerts that fired correctly and were not acted on for days. Vulnerability scans that were purchased and never run. Software years past the end of support. None of these are exotic failures, and all of them are cheaper to fix in advance than to explain afterwards.

Fines can be substantial — up to £17.5 million or 4% of global annual turnover for the most serious infringements — but for a small business the realistic exposure is the combination of forensic costs, remediation, lost trading and lost customers. The regulator has also made clear that a small turnover does not put a floor under the penalty: in one 2025 case the calculated figure was increased specifically because the arithmetic result would not have been dissuasive.

What should you prepare now?

An incident response plan is a PCI DSS requirement, and it is also the difference between a bad day and a catastrophe. The standard is specific about two things people leave out: the plan must set out how you will notify the card brands and your acquirer, and it must be reviewed and tested at least once every twelve months. Testing does not mean a simulated cyber attack — walking two people through the plan and finding out that the emergency contact left in March counts, and is usually what the exercise actually reveals.

It does not need to be long, either. One page, printed and kept somewhere that does not depend on your systems being available, covering: who is in charge, who to call in what order, the accounts you would need to disable, your acquirer's incident number, your insurer's number, and the containment steps above.

The other half of preparedness is your staff, because they are usually the ones who notice first. Our guide to training staff to spot card fraud covers what to teach them and why blameless reporting saves so much money.

Key takeaways

• The 72-hour ICO clock starts when you become aware, not when the breach happened — and losing access to data counts as a breach.
• Isolate systems but do not switch them off, wipe them or delete anything; preserve logs before they rotate.
• Report in phases rather than late, document any decision not to report, and keep an internal record of every breach regardless.
• Tell individuals where there is a high risk to them, and tell your acquirer promptly — that duty is contractual, not statutory.
• The forensic investigation, not the fine, is usually the largest bill a small merchant faces after a card data compromise.

Being able to show you were compliant when it happened changes the conversation with your acquirer entirely. Fraud Defence First's fully managed PCI compliance service keeps that evidence current — the right questionnaire, completed properly, filed with your acquirer and renewed each year, for a flat £100 + VAT.