Trigger
Personal data breach suspected or confirmed.
First 24 hours
- Assemble incident team; contain and assess impact.
- Decide reportability to ICO within 72 hours; start evidence log.
By 72 hours
- If notifiable, report to ICO with known facts and mitigation; update as needed.
- Notify affected individuals if high risk.
Post‑incident
Root‑cause analysis, lessons learned, update policies and DPIAs.