Security
Data Breach Response Playbook
The first hour, the first day and the 72-hour window.
- Format
- Length
- 17 pages
- Edition
- 1st edition, November 2026
- Published
- 2 November 2026
- Publisher
- Data Menu
About
About this guide
A practical playbook for responding to a personal data breach in the UK. It sets out what counts as a breach, who does what in the first hour, how to assess the risk, when and how to report to the ICO within 72 hours, how to tell the people affected, and who else you may need to notify.
Includes a breach log, a rapid risk assessment, an ICO notification worksheet, a message to affected individuals, a 72-hour clock and a post-incident review template.
General educational guidance written by Data Menu. It is not legal advice.
Contents
What is inside
- What counts as a personal data breachThe three types of breach and common examplesp. 4
- The first hour: contain, assemble, preserveRoles, and the first-hour stepsp. 5
- Assess the riskThe two questions and weighing the riskp. 7
- Notifying the ICO within 72 hoursWhat to tell the ICO and how to report in phasesp. 9
- Telling the people affectedWhen and how to tell individualsp. 10
- Everyone else you may need to tellProcessors, police, insurers and other regulatorsp. 12
- Record, review, improveRecording every breach and holding a reviewp. 13
- Typical scenariosEight common scenariosp. 14
- Templates and checklistsBreach log, risk assessment, worksheet and checklistsp. 15
Audience
Who it is for
- Owners and directors
- IT and operations leads
- Anyone who would be on the call when a breach happens
Delivery. After payment you can download the PDF straight away, and we email you a personal link to the same page. Each purchase is a single download, so please save the file somewhere safe when it arrives. If a download is interrupted, you can retry from that page for a few minutes. Our guides are practical, educational material. They are not legal advice. If you need advice on your own situation, speak to a qualified adviser.