What is ICO Data Breach Notification?

Under UK GDPR, organisations must notify the Information Commissioner of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to pose a risk to data subjects. Where risk is high, affected individuals must also be told without undue delay. The ICO maintains an online breach-reporting form. Failure to notify is itself an infringement.