Data breach response plan

A data breach is a misdirected email, a lost laptop, a mailbox compromised by a phishing link, a ransomware attack or a spreadsheet uploaded to the wrong folder, and the law gives the business seventy-two hours from becoming aware of it to decide whether to notify the regulator and to do so. Most businesses lose the first day because nobody knew who to tell, the second because nobody knew how to assess the risk, and the third because nobody knew what the notification needed to say. The plan gives the business the roles, the steps, the assessment and the templates. I draft the plan with the data processing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Businesses in England and Wales of any size, and businesses whose cyber insurer or customer has asked to see the plan.

What matters in a data breach response plan

What a breach is and the one that nobody reported

A personal data breach under Article 4 of the UK GDPR is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data, which covers the misdirected email, the lost device, the compromised account, the paper left on the train and the data deleted without a backup, as well as the cyber attack; the plan starts by telling every member of staff what counts, that reporting a breach to the named person at once is required and will not be punished, and where to report, because the breach the business discovers late is the one it cannot notify in time, and a culture in which a misdirected email is quietly recalled and not mentioned is the risk the plan exists to remove.

The first hours, containment and the people who decide

The plan names the response lead and the deputies, the IT provider and the lawyer to call, and the steps in the first hours: contain the breach (recall the email and ask the recipient to delete, remotely wipe the device, reset the credentials, isolate the system, stop the upload), preserve the evidence (logs, the message, the device), establish the facts (what data, how many people, what happened, when, whether it is continuing), and open the incident record with the time the business became aware, which is the time the seventy-two hours runs from; the plan is written so that whoever finds the breach on a Friday evening knows who to call and what to do before Monday.

The assessment, the risk and the seventy-two hours

Article 33 of the UK GDPR requires the business to notify the Information Commissioner's Office without undue delay and where feasible within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk to individuals' rights and freedoms, and the plan contains the assessment that decides it: the nature and sensitivity of the data (financial, health, children's, credentials), the number of people, the likelihood of harm (identity fraud, financial loss, distress, physical safety), the protections in place (encryption, the recipient's confirmation of deletion), and the people affected (vulnerable individuals raise the risk); a misdirected email with one name and an address, deleted on request, is usually not notifiable; a spreadsheet of customers' bank details sent to a stranger is; the assessment is recorded either way.

Notifying the regulator and what the notification says

The notification to the Information Commissioner's Office (through its online form) must describe the nature of the breach, the categories and approximate numbers of individuals and records, the contact point, the likely consequences and the measures taken or proposed, and may be made in phases where the information is not all available within seventy-two hours (with the reasons for delay given), which the plan's template sets out so that the lead is completing fields rather than composing; a late notification must explain the delay, and the plan is clear that notifying on incomplete information within the time is better than notifying on complete information after it.

Telling the individuals and the suppliers, insurers and police

Article 34 requires the business to tell the individuals without undue delay where the breach is likely to result in a high risk to them (unless the data was encrypted, the risk has been removed or individual notice would be disproportionate, in which case a public communication is used), in clear language describing what happened, the likely consequences, the measures taken and what they can do, and the plan contains the template and the decision on channel; the plan also lists the others to tell: the business's processors and controllers under the data processing agreement (a processor must tell the business without undue delay under Article 33(2), and the business must tell its own customers where it is their processor), the cyber insurer within the policy's notification window, the bank where payment data is involved, and the police through Action Fraud where a crime has occurred.

The record, the lessons and the breach register the law requires

Article 33(5) requires the business to document every personal data breach, notified or not, with the facts, the effects and the remedial action, and the plan contains the register (date, description, data, people, assessment, decision, notifications, actions) which the regulator inspects and which shows the breaches the business decided not to notify and why; after the incident the plan requires a review (what failed, what the business will change, the training that follows), the privacy notice drafted alongside states the business's security and contact point, and the data processing agreement requires its processors to notify and assist; the note that comes with the documents lists the preparations the plan assumes (the contact sheet filled in, the insurer's number to hand, the IT provider's incident commitment in the contract, a tabletop run-through with the staff who would be involved).

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we have to report every breach to the regulator?

No: only those likely to result in a risk to individuals, which the plan's assessment decides, within seventy-two hours of becoming aware. Every breach is recorded in the register whether or not it is notified, and the record shows the regulator the decision.

A member of staff sent a customer's details to the wrong person. What do we do?

Contain it (ask the recipient to delete and confirm), record the time you became aware, assess the risk from the data involved, decide on notification within seventy-two hours and log it. One name and an address deleted on request is usually not notifiable; financial or health data is a different assessment.

When do we tell the individuals?

Where the breach is likely to result in a high risk to them, without undue delay, in plain language with what happened and what they can do. The plan's template and the decision on channel are ready before the breach.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Subject access request procedure
• Data processing agreement for an IT support provider

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.