Free tool
Your 72-hour breach reporting deadline
Enter when you found out about a personal data breach. We'll show the deadline for telling the ICO, help you decide whether it needs reporting, and list what to record. Nothing you enter leaves your browser.
How the rules work
Under UK GDPR Article 33, if a personal data breach is likely to put people's rights and freedoms at risk, you must tell the Information Commission (the ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. If it's unlikely to put anyone at risk, you don't have to report it, but you must still record it and your reasons.
Under Article 34, if the risk to people is high, you must also tell the people affected without undue delay, unless the data was protected, for example by encryption, you've since made the high risk unlikely, or contacting everyone would take disproportionate effort, in which case you make a public announcement instead.
What to record for every breach
- What happened, when, and when you found out
- What personal data was involved and whose
- The likely effects on the people concerned
- What you did to contain it and stop it happening again
- Whether you reported it, and if not, why not
Reporting to the ICO
Report online at any time, or call 0303 123 1113, usually open Monday to Friday, 9am to 5pm. Not sure if it's reportable? The ICO has a self-assessment.
General information, not legal advice. Checked against UK GDPR and ICO guidance on 21 October 2026.
If someone put client data into ChatGPT
Pasting a client's details into a free or personal AI account sends them to a company your firm has no contract with. That can be a personal data breach, so treat it like one: record it, work out the risk to the people involved, and use the calculator above to see if and when you need to tell the ICO.
Then stop it happening again. Our guide explains what counts as personal data, which AI plans are safe and what UK data protection law expects.
Questions
About reporting personal data breaches.
When does the 72 hours start?
When you become aware of the breach, which the ICO describes as having a reasonable degree of certainty that a breach has happened. It doesn't start when the breach itself happened, if you only found out later.
Does the 72 hours include weekends?
The ICO's wording is "within 72 hours of becoming aware of the breach, where feasible" and it doesn't mention working days, so this calculator counts 72 hours on the clock, evenings and weekends included. The ICO's phone line is open on weekdays only; outside those hours, report online.
What if I can't give the ICO all the details in time?
Report what you know within the deadline. UK GDPR allows you to provide the rest in phases, without undue further delay. If you report after 72 hours, you must explain the delay.
Do I have to record a breach I don't report?
Yes. Every personal data breach must be recorded, including its facts, its effects and what you did about it, whether or not it needs reporting.
Is putting client data into a free AI tool a breach?
In our reading, sending personal data to an AI provider with no contract with your firm is a personal data breach, though the ICO hasn't ruled on this specific situation. Assess it like any other breach.
Catch it before it becomes a breach
Saiela stops personal data reaching free AI tools, alerts you when something needs assessing and keeps a breach register with the 72-hour reminder, free on every plan.