The 72-Hour Clock: A Calm, Practical Response Plan for a Small Business Data Breach

Few events concentrate the mind of a small business owner quite like the realisation that personal data has gone astray. Perhaps a laptop was stolen from a car overnight. Perhaps a member of staff emailed a spreadsheet of client details to the wrong recipient. Perhaps the worst has happened and your systems have been breached by an external actor. Whatever the cause, the initial instinct — panic, followed by an urge to bury the problem — is precisely the wrong response, both ethically and legally.

The UK GDPR does not require perfection. It requires promptness, honesty and a documented, proportionate response. This guide walks through the first two days after discovery, when decisions matter most.

Hour One: Establish the Facts Before You Touch Anything

Resist the temptation to delete, wipe or 'fix' anything immediately. Your first task is containment, not destruction. Disconnect affected systems from the network if an attack is ongoing, change compromised credentials, and preserve logs and evidence — the Information Commissioner's Office (ICO) may later want to understand exactly what occurred.

At the same time, start a written chronology. Note when the breach was discovered, by whom, and what is known so far. This record will underpin any notification you make and will demonstrate good faith if the matter is ever scrutinised.

Assess the Risk: Is This Actually Reportable?

Not every incident requires notifying the ICO. The threshold is risk to the individuals affected. A misdirected internal email containing no personal data is a nuisance; a stolen file of customer names, addresses and payment details is plainly more serious.

Ask three questions:

• What data was involved? Special category data — health records, financial information, anything revealing beliefs or biometrics — raises the stakes considerably.
• How many people are affected? Scale matters, but a single individual exposed to identity theft can still trigger a duty to report.
• What are the likely consequences? Consider distress, discrimination, financial loss and loss of confidentiality.

If the answer to 'is there a risk to individuals?' is yes or even unclear, the default position should be to report. The ICO's own guidance encourages organisations to seek advice where they are uncertain, and a well-reasoned decision either way — documented at the time — carries significant weight.

The 72-Hour Rule, Explained Without Alarm

The reporting window runs from the moment of awareness, not the moment of the breach itself. If a breach occurred on Monday but was only discovered on Thursday, the clock starts on Thursday. You have 72 hours to notify the ICO without undue delay.

Crucially, the initial notification need not be complete. The ICO accepts that a full picture may take days or weeks to assemble. What is required is an initial report setting out the nature of the breach, the categories and approximate number of individuals affected, likely consequences, and the measures you propose to take. You can update this in phases.

Failure to notify within the window is itself an infringement, separate from the breach, and is the kind of regulatory lapse that turns a manageable incident into an aggravated one.

Telling the People Affected

Where the breach is likely to result in high risk to individuals — as opposed to mere risk — you must also inform them directly, and without undue delay. This is where many businesses falter, paralysed by the fear of reputational damage.

The counter-intuitive truth is that a clear, prompt, honest notification usually preserves trust rather than destroying it. Your communication should:

• Explain in plain English what happened and when
• Specify what data was involved — and, importantly, what was not
• Set out concrete steps individuals can take, such as resetting passwords or monitoring bank statements
• Provide a named contact for questions

Avoid legalese and avoid minimising language. Recipients who feel patronised are far more likely to complain to the ICO than recipients who feel respected.

Who Else Needs to Know?

Depending on the circumstances, you may have further obligations. If your business processes data on behalf of clients — as a bookkeeper, IT provider or marketing agency, for instance — your contracts may require prompt notification to those clients, who then carry their own reporting duties. Check your data processing agreements before the clock forces you to.

If payment card data is involved, your merchant acquirer should be notified. If criminality is suspected, a report to Action Fraud may be appropriate. And if your business holds professional insurance, put your insurers on notice early — policies often require this within a defined period, and many include access to specialist breach response support.

The Days After: Turning a Crisis into a Record of Good Practice

Once the immediate response is under way, attention turns to root cause and remediation. The ICO will want to see that you have not merely patched the hole but understood why it existed. Was it a training gap? A missing technical control? An out-of-date procedure? Document your investigation and the steps taken.

This is also the moment to review your wider data protection posture. Businesses that can demonstrate a genuine commitment to accountability — staff training, sensible retention policies, a named individual responsible for data protection — fare far better in any regulatory conversation than those treating compliance as a box-ticking exercise.

When to Take Legal Advice

There is no shame in being out of your depth. Specialist advice is particularly valuable if the breach involves special category data, affects a large number of individuals, or if affected parties have already begun raising claims — group actions for data breaches have grown considerably in the UK in recent years.

A data breach handled badly can cost a business its reputation, its clients and, in serious cases, its existence. Handled properly — promptly, transparently and with documented judgment — it is an incident, not a catastrophe. The 72-hour clock is unforgiving, but it rewards those who act with method rather than panic.

This article is for general information only and does not constitute legal advice. If your business has experienced a data breach, seek advice tailored to your specific circumstances.