Do we need to report a cyber attack? UK rules for small businesses

If a cyber attack affects personal data and is likely to put people at risk, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it, and to tell the people affected without undue delay if the risk to them is high. Reporting the crime to the police and the NCSC isn't a legal requirement for most businesses, but it's free and worth doing. Sometimes the NCSC have access to decryption tools now or in the future, so it's worth registering your incident with them. Your bank, insurer and any regulator of your profession may have their own requirements too, and whatever you decide, write it down.

How many businesses report?

In the government's Cyber Security Breaches Survey 2025/26, only 40% of businesses that had a breach or attack reported their most disruptive one to anyone outside the organisation, and just 2% of those that reported it externally told the ICO. Only 25% of businesses had a formal incident response plan.

Many incidents don't need reporting to the ICO. But some that do aren't reported, and the time to work out which is which isn't the middle of an attack.

Who you must tell: the ICO

The ICO's guidance is the starting point for most businesses, because almost every business holds personal data about customers, clients or staff.

• What counts. A personal data breach is personal data being lost, destroyed, changed, disclosed or accessed without permission. That includes losing access to it, as in ransomware, not only having it stolen.
• When to report. If the breach is likely to put people's rights and freedoms at risk, report it as soon as possible and, where feasible, within 72 hours of becoming aware of it. The clock starts when you're reasonably sure a breach has happened, not when you finish investigating.
• Report early, update later. You won't have every answer within 72 hours. The ICO asks you to report with what you know and add details as you find them.
• How. Through the ICO's online form, which takes around 30 minutes. It can't be saved part-way, so gather the basics first: what happened, when you found out, what data and how many people may be affected, and what you've done.

The ICO's breach guidance is under review following the Data (Use and Access) Act 2025, so check its website for the latest version.

When to tell the people affected

If a breach is likely to pose a high risk to the people whose data was involved, you must tell them without undue delay. For example, if bank details, passwords or medical information may have been taken, people need to know so they can protect themselves.

Tell them plainly what happened, what data was involved, what you're doing about it and what they should do, such as watching for scam emails that use their details.

Who you should tell

These aren't legal requirements for most small businesses, but each one helps:

• The police and the NCSC. If an attack is happening now, call 0300 123 2040, which the NCSC says is available 24 hours a day for businesses suffering a live cyber attack. Otherwise report it online at gov.uk/report-cyber. In Scotland, call Police Scotland on 101.
• Your bank, straight away, if money has been sent or payment systems or banking logins may be involved.
• Your cyber insurer, as soon as possible. Most policies require prompt notification, and many give you an incident helpline. Check your policy for its notification terms.
• Your professional regulator. Solicitors, accountants, financial services firms and other regulated businesses may have their own reporting rules on top of UK GDPR.
• Customers and suppliers whose systems or payments could be affected, so they can protect themselves. Phone them rather than relying on email if your email may be compromised.

What to write down, from the start

UK GDPR requires you to keep a record of every personal data breach, including those you decide not to report. A good incident log helps with everything above, and with your insurer if you claim. Record:

• When you first noticed something wrong, and when you became sure it was a breach.
• What happened, in plain words, and what systems and data were affected.
• Who may be affected, and roughly how many people.
• What you did, and when: each step, who did it, and who you told.
• Your decisions, including why you did or didn't report to the ICO or tell the people affected.

Keep the log somewhere the attackers can't reach, such as on paper or a device that wasn't affected. Don't delete anything from affected systems either: logs and files can show what happened, and a digital forensics investigation can turn them into a report your insurer and the ICO can rely on.

Get ready before you need it

The best time to decide who reports what is before anything goes wrong. Write down who in your business makes the call to the ICO, your insurer's notification number and policy number, and where the incident log lives. Keep a copy offline. Our guide to writing an incident response plan has an outline you can adapt.

Our incident readiness service helps you write and test that plan. If you're dealing with an attack right now, see our guide to the first hour of a ransomware attack, or get emergency help.

< Back to Guides