Security & IncidentsUpdated June 2026; refreshed July 8, 202611 min read

Personal Data Breach Notification Requirements in Ireland and the UK

AAcompli Research

In both Ireland and the UK, a personal data breach that is likely to result in a risk to people must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. This guide sets out the deadlines, thresholds and content rules for the DPC and the ICO side by side.

Data breach notification timeline and risk assessment for Ireland and the UK

On this page

1 / 11

01Security & Incidents

Is breach notification a legal obligation in Ireland and the UK?

Yes. In both Ireland and the UK, notifying a personal data breach is a legal obligation, not a matter of discretion. The duty arises from the same source text: Article 33 of the EU GDPR in Ireland (an EU Member State) and the materially identical Article 33 of the UK GDPR following Brexit. A controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

The two regimes diverged in form but not in substance. Ireland applies the EU GDPR as supplemented by the Data Protection Act 2018, enforced by the Data Protection Commission (DPC). The UK applies the UK GDPR as supplemented by the Data Protection Act 2018 (UK), enforced by the Information Commissioner's Office (ICO). The 72-hour deadline, the risk threshold, the high-risk threshold for telling individuals, and the duty to keep an internal record of every breach are the same on both sides of the Irish Sea.

For an organisation operating in both jurisdictions, the practical question is rarely whether the duty exists. It is which regulator (or both) must be told, against which clock, and how to evidence the risk decision after the fact. This guide answers those questions for a buyer comparing obligations across the DPC and the ICO.

02Security & Incidents

The 72-hour rule: when the clock starts and what it requires

Under Article 33(1) of the EU GDPR and the identical UK GDPR provision, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The phrase that matters is becoming aware: the clock starts when the controller has a reasonable degree of certainty that a security incident has occurred that compromised personal data, not at the first hint of an anomaly. A short period of investigation to establish whether a breach has in fact happened is permitted before awareness crystallises.

The 72 hours is a calendar-time deadline, including weekends and public holidays, not 72 working hours. If notification is made after 72 hours, it must be accompanied by reasons for the delay (Article 33(1)). Both the DPC and the ICO accept that an organisation may not have all the facts within the window, and both allow an initial notification to be supplemented in phases.

Article 33(2): a processor that becomes aware of a breach must inform the controller without undue delay; the controller, not the processor, notifies the authority.
Article 33(4): where it is not possible to provide all the information at the same time, the information may be provided in phases without undue further delay.
Threshold to notify the authority: any risk to the rights and freedoms of natural persons. Only a breach that is unlikely to result in a risk is exempt from notification.
Threshold to notify individuals (Article 34): a likely high risk to those individuals — a deliberately higher bar.

03Security & Incidents

Risk vs high-risk: the two thresholds that decide who you tell

Breach response in both jurisdictions turns on a two-tier risk assessment. The first tier governs whether you must notify the regulator; the second governs whether you must also notify affected individuals. Getting these thresholds right is the single most consequential judgement in the process, because over-notifying floods the regulator and under-notifying is itself an infringement.

Notification to the supervisory authority (DPC or ICO) is required wherever the breach is likely to result in a risk to people. Communication to the affected individuals under Article 34 is required only where the breach is likely to result in a high risk to them — for example exposure of special category data, financial data enabling fraud, or data that could lead to identity theft, discrimination or physical harm. The DPC's breach notification form asks the controller to apply a self-declared risk rating (Low, Medium, High or Severe) and the ICO provides a self-assessment tool; both are aids to the same statutory test, not substitutes for it.

Unlikely to result in a risk: record it internally, notify no one externally.
Likely to result in a risk: notify the supervisory authority within 72 hours; assess whether individuals need telling.
Likely to result in a high risk: notify the supervisory authority AND communicate to affected individuals without undue delay.
Article 34(3) exemptions from telling individuals: effective encryption rendering the data unintelligible; measures taken that mean the high risk is no longer likely to materialise; or where individual contact would involve disproportionate effort (then a public communication instead).

04Security & Incidents

What a notification to the regulator must contain (Article 33(3))

Article 33(3) sets out the minimum content of a notification to the supervisory authority. The same four headings apply whether you are filing the DPC web form or the ICO report. Where you cannot answer fully at the 72-hour point, file what you have and supplement in phases under Article 33(4) rather than waiting.

(a) The nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned.
(b) The name and contact details of the data protection officer or other contact point where more information can be obtained.
(c) The likely consequences of the personal data breach.
(d) The measures taken or proposed to be taken to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

05Security & Incidents

Notifying affected individuals (Article 34)

Where the breach is likely to result in a high risk to individuals, Article 34 requires the controller to communicate the breach to those individuals without undue delay. The communication must be in clear and plain language and describe the nature of the breach, and it must contain at least the information in points (b), (c) and (d) of Article 33(3) — the DPO or contact point, the likely consequences, and the measures taken or proposed (including any steps the individual can take to protect themselves).

Both the DPC and the ICO can compel an organisation to notify individuals if the regulator considers the breach high risk and the controller has not done so (Article 34(4)). In practice, the decision to communicate to individuals is a high-stakes judgement that should be documented as carefully as the decision not to: it is exactly the point at which the high-risk threshold is tested.

06Security & Incidents

Record-keeping: the obligation that applies to every breach (Article 33(5))

This is the obligation most often missed. Article 33(5) requires the controller to document all personal data breaches — the facts of the breach, its effects, and the remedial action taken — regardless of whether the breach was notifiable. The DPC and the ICO both confirm that this internal record must exist even where you concluded there was no risk and therefore told no one. The record is what enables the supervisory authority to verify compliance, and an absent or thin breach log is a common finding in regulatory engagement.

A defensible record captures more than the incident itself: it captures the reasoning. Who assessed the risk, against which criteria, what rating was reached, why notification was or was not required, and when each step was taken. This contemporaneous trail is the difference between a confident answer to a regulator and a reconstruction months later. Acompli's breach record is structured to capture that trail as the incident is handled — who assessed the risk, the criteria and rating applied, and the timing of each step — with a human approving the conclusion.

Document every breach, notifiable or not — the duty is universal under Article 33(5).
Capture the facts, the effects, and the remedial action taken.
Capture the risk decision and its rationale, including the no-risk conclusions.
Retain the record so the DPC or ICO can verify compliance on request.

07Security & Incidents

DPC (Ireland) vs ICO (UK): a side-by-side comparison

The substantive law is near-identical because both derive from the GDPR text, but the regulators, the reporting channels and some procedural details differ. The table below sets out the practical contrasts a dual-jurisdiction organisation needs. Note the fine rows: a failure to notify under Article 33 or 34 falls into the lower fining tier in both regimes (Article 83(4)), not the headline maximum that applies to the most serious infringements such as breaches of the basic processing principles.

Ireland — DPC (EU GDPR + DPA 2018)	UK — ICO (UK GDPR + DPA 2018 (UK))
Supervisory authority: Data Protection Commission (DPC)	Supervisory authority: Information Commissioner's Office (ICO)
Governing law: EU GDPR + Data Protection Act 2018 (Ireland)	Governing law: UK GDPR + Data Protection Act 2018 (UK)
Deadline to notify authority: without undue delay, where feasible within 72 hours	Deadline to notify authority: without undue delay, where feasible within 72 hours
How to report: DPC online Breach Notification web form (forms.dataprotection.ie); follow-ups quote the DPC case/reference number	How to report: ICO online report-a-breach service plus a self-assessment tool; personal data breach advice line for urgent or uncertain cases
Risk thresholds: notify the DPC on any likely risk; tell affected individuals on likely high risk (Article 34)	Risk thresholds: notify the ICO on any likely risk; tell affected individuals on likely high risk (Article 34)
Self-assessment aid: self-declared risk rating on the form (Low / Medium / High / Severe)	Self-assessment aid: ICO self-assessment tool that walks you through whether the breach is notifiable
Special sectors: separate NIS2 cyber-incident reporting duties pending via the National Cyber Security Bill 2024 (transposition still in progress)	Special sectors: PECR Regulation 5A applies to public electronic communications service providers (now aligned toward the 72-hour GDPR model by the DUAA 2025)
Recent volume: 7,781 valid breach notifications received by the DPC in 2024 (up around 11% on 2023)	Recent volume: 12,412 personal data breach reports received by the ICO in 2024/25
Fines for failing to notify (Article 33/34): lower tier under Article 83(4) — up to EUR 10m or 2% of global annual turnover, whichever is higher. The EUR 20m / 4% maximum (Article 83(5)) applies to the most serious infringements.	Fines for failing to notify (Article 33/34): standard maximum under DPA 2018 s.157 — up to GBP 8.7m or 2% of global annual turnover, whichever is higher. The GBP 17.5m / 4% higher maximum applies to the most serious infringements.

08Security & Incidents

How to file: the DPC web form and the ICO reporting service

Mechanically, the two regulators differ. The DPC requires breaches to be submitted through its online Breach Notification web form, which captures controller details, how the breach was discovered, the security and organisational measures in place beforehand, whether special category data or cross-border data subjects are affected, and the self-declared risk rating. Where the DPC is the lead supervisory authority for a cross-border breach under the GDPR one-stop-shop, the form captures the additional cross-border information.

The ICO operates an online report-a-breach service alongside a self-assessment tool that walks an organisation through whether the incident is notifiable, plus a personal data breach advice line for urgent or out-of-hours queries. In both jurisdictions, an initial notification can be filed on incomplete information and updated in phases under Article 33(4) — filing on time with a phased follow-up is preferable to a late but complete report.

Ireland: gather controller, discovery, prior-measures and data-category details before opening the DPC web form; keep the DPC case/reference number for any update.
UK: run the ICO self-assessment first to confirm the breach is notifiable, then file via the ICO report-a-breach service.
Both: if you cannot complete every field within 72 hours, file a partial notification and supplement it under Article 33(4).

09Security & Incidents

Common pitfalls that turn a breach into an infringement

Most regulatory criticism in this area is not about the underlying security incident — it is about how the organisation responded to it. The recurring failures are procedural and avoidable. In Acompli, the incident workflow prompts the risk and high-risk assessments in sequence and keeps the internal record for every breach, including the no-risk conclusions, so these procedural gaps do not open in the first place.

Starting the clock too late: treating awareness as the moment the investigation finishes rather than the moment a breach is reasonably confirmed.
Failing the universal record-keeping duty: keeping no Article 33(5) log for breaches assessed as no-risk, leaving nothing for the regulator to verify.
Confusing the two thresholds: notifying individuals for every risk (causing alarm fatigue) or, worse, withholding notification where high risk plainly applies.
Relying on a processor to notify the authority: only the controller notifies the DPC or ICO; the processor's duty is to alert the controller without undue delay.
Forgetting sector overlays: communications providers in the UK have PECR duties, and Irish operators of essential and important entities will have separate NIS2-derived incident-reporting duties on a different timeline.
Not documenting the risk rationale: a defensible decision needs the who, the criteria, the rating and the timing recorded contemporaneously, not reconstructed.

10Security & Incidents

2026 regulatory developments to watch

The core GDPR breach framework is stable, but the surrounding obligations are moving in both jurisdictions during 2026. None of these changes the 72-hour GDPR rule itself, but they layer additional or aligned duties on top of it.

In the UK, the Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, with a substantial set of provisions commencing on 5 February 2026 and further provisions following through secondary legislation. Among its measures, it aligns the PECR breach-reporting timeline for public electronic communications service providers toward the GDPR's without-undue-delay / 72-hour model, easing the previous 24-hour Regulation 5A position. Organisations should confirm the precise commencement of provisions relevant to them against the ICO's guidance.

In Ireland, NIS2 (Directive (EU) 2022/2555) is being transposed through the National Cyber Security Bill 2024; transposition was not completed by the EU's 17 October 2024 deadline and remained in progress through 2025, with publication of the Bill treated as a priority into 2026. For in-scope essential and important entities, NIS2 introduces a separate cyber-incident reporting cascade — an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month — which runs in parallel with, and does not replace, the GDPR breach duty owed to the DPC.

11Security & Incidents

Building audit-ready breach readiness (and where Acompli assists)

The organisations that handle breaches well are not the ones that respond fastest in the moment — they are the ones that decided, in advance, how awareness is recognised, who assesses risk, against which criteria, and where the record lives. A 72-hour deadline is unforgiving if the first 24 hours are spent deciding who owns the decision.

Acompli's software is designed to assist this readiness rather than replace the people accountable for it. The platform can help draft a structured breach record aligned to Article 33(3) and 33(5), classify and surface the data categories likely to be affected, route the incident to the right reviewers, and prompt the risk and high-risk assessment so a step is not skipped. Every output is put forward for human review: a DPO, privacy lead or lawyer makes the notification decision and approves what is filed. Acompli does not make autonomous legal judgements and does not file with a regulator on your behalf without sign-off — it is intended to shorten the path to a defensible, well-evidenced human decision.

Drafts and structures the Article 33 notification content and the Article 33(5) internal record for human review.
Classifies and surfaces likely-affected data categories to speed the risk assessment a person then confirms.
Routes incidents to the right reviewers and helps maintain a contemporaneous, exportable decision trail.
Keeps a human in control: the DPO, privacy lead or legal team approves every notification and every risk decision.

Where Acompli fits for breach readiness

Best for privacy teams that need the breach decision to be a defensible record, not a reconstructed incident note: Acompli structures the Article 33(3) notification fields and the Article 33(5) internal log, prompts the risk and high-risk assessment, records who approved the decision, and keeps each step exportable for a DPC or ICO review. The software assists the workflow; the notification judgement stays with the DPO, privacy lead or lawyer.

See Acompli risk management workflows

Primary sources

Breach notification FAQs for Ireland and the UK

Do I have to report a breach to both the DPC and the ICO if my organisation operates in Ireland and the UK?

It depends on where the affected individuals are and which law applies to the processing. A breach affecting people in Ireland and the wider EU is reportable to the DPC under the EU GDPR, while a breach affecting people in the UK is reportable to the ICO under the UK GDPR. Many cross-border organisations have to notify both regulators for the same incident where it touches data subjects in each jurisdiction. There is no single one-stop-shop that spans both the EU and the UK since Brexit, so you should assess your EU and UK obligations separately and notify each competent authority where the breach reaches the risk threshold for that jurisdiction.

When does the 72-hour clock actually start?

The clock starts when you become aware of the breach, meaning when you have a reasonable degree of certainty that a security incident has occurred that compromised personal data. It does not start at the first vague alert or anomaly, and a short, focused investigation to confirm whether a breach has genuinely happened is permitted before awareness crystallises. The 72 hours is calendar time, including weekends and public holidays, not 72 working hours. Both the DPC and the ICO apply the same test, so your internal incident process should define clearly what counts as becoming aware so the start point is consistent and defensible.

What is the difference between notifying the regulator and notifying affected individuals?

They are governed by two different thresholds. You must notify the supervisory authority (the DPC in Ireland or the ICO in the UK) wherever the breach is likely to result in any risk to people. You must additionally communicate the breach to the affected individuals only where it is likely to result in a high risk to them, such as exposure of special category or financial data that could lead to fraud, identity theft, discrimination or physical harm. So a breach can be reportable to the regulator without requiring you to tell the individuals, but a high-risk breach generally triggers both.

Do I have to report a breach if I do not think it is serious?

You only have to notify the regulator if the breach is likely to result in a risk to the rights and freedoms of individuals; a breach that is unlikely to result in any risk is exempt from external notification. However, you must still document every breach internally, including the ones you decide not to report, recording the facts, the effects, the remedial action and your reasoning for concluding there was no risk. This internal record is required under Article 33(5) in both Ireland and the UK and is exactly what the DPC or ICO will expect to see if they later examine how you handled the incident.

What information does the DPC web form or ICO report require?

Both follow Article 33(3). You provide the nature of the breach including the approximate number of individuals and records affected, the contact details of your data protection officer or contact point, the likely consequences of the breach, and the measures you have taken or propose to take to address it and mitigate harm. The DPC form captures additional detail on the security measures in place beforehand and any cross-border element, while the ICO offers a self-assessment tool to confirm the breach is notifiable. If you cannot complete every field within 72 hours, file what you have on time and supplement the rest in phases, which both regulators expressly allow.

What happens if we miss the 72-hour deadline?

Missing the deadline does not remove the obligation; you must still notify, and you must include the reasons for the delay, as required by Article 33(1). A late notification with a credible explanation is treated very differently from a non-notification or a concealed breach. Failing to notify when required is itself an infringement and can attract a penalty. A failure to notify falls into the lower fining tier in both regimes: in the UK the ICO can impose a fine of up to 8.7 million pounds or 2% of global annual turnover, whichever is higher, and in Ireland the DPC can impose a fine of up to 10 million euro or 2% of global annual turnover, whichever is higher. The higher maximums, 17.5 million pounds or 4% in the UK and 20 million euro or 4% in Ireland, are reserved for the most serious infringements such as breaches of the basic processing principles. Filing on time, even on partial information, is always the stronger position.

Are there extra breach-reporting rules for specific sectors?

Yes. In the UK, providers of public electronic communications services have additional duties under PECR (the Privacy and Electronic Communications Regulations 2003, Regulation 5A), a regime that historically used a stricter 24-hour timeline and that the Data (Use and Access) Act 2025 has aligned toward the GDPR 72-hour model. In Ireland, organisations that qualify as essential or important entities will have separate cyber-incident reporting duties derived from the NIS2 Directive, with its own cascade of an early warning, an incident notification and a final report. These sector rules sit on top of the GDPR breach duty rather than replacing it, so an in-scope organisation can owe parallel reports to different authorities on different clocks for the same incident.

Who is responsible for notifying when a supplier or processor causes the breach?

The controller is always responsible for notifying the supervisory authority; a processor does not notify the DPC or ICO directly on the controller's behalf. Under Article 33(2), a processor that becomes aware of a breach must inform the controller without undue delay, and the controller's own 72-hour clock effectively runs from when it becomes aware through that notification. This is why your data processing agreements should require prompt, detailed breach alerts from suppliers, and why your incident process should be able to absorb a third-party report and act on it quickly. A weak supplier-notification chain is a common reason controllers miss their own deadline.

How long do we have to notify affected individuals, and can we ever avoid it?

Where the breach is likely to result in a high risk, you must communicate it to the affected individuals without undue delay, in clear and plain language, covering the nature of the breach, the likely consequences and the measures taken including any steps they can take to protect themselves. Article 34(3) provides limited exemptions: if the data was effectively encrypted and remains unintelligible, if you have since taken measures that mean the high risk is no longer likely to materialise, or if individual contact would involve disproportionate effort, in which case you make a public communication instead. The DPC and the ICO can still order you to notify individuals if they disagree with your assessment.

How can software help us be audit-ready without overclaiming?

Software helps most before an incident, by making the response repeatable and evidenced. A tool like Acompli can draft the structured breach record aligned to Article 33(3) and the internal log required by Article 33(5), classify and surface the data categories likely to be affected, route the incident to the right reviewers and prompt the risk and high-risk assessment so no step is skipped. Crucially, it is designed to assist rather than decide: the notification decision and the risk judgement are made and approved by a human, such as your DPO, privacy lead or lawyer, and nothing is filed without sign-off. The value is a faster, better-documented and more defensible human decision within the 72-hour window, not an automated legal judgement.

Market-specific questions (Deutschland / France / Nederland)

An wen und in welcher Frist müssen wir eine Datenpanne in Deutschland melden?

In Deutschland gibt es keine einzige nationale Datenschutzbehörde. Die meisten privatwirtschaftlichen Unternehmen melden eine Verletzung des Schutzes personenbezogener Daten an die zuständige Aufsichtsbehörde ihres Bundeslandes (etwa LfDI Baden-Württemberg, BayLDA in Bayern oder die Berliner Aufsichtsbehörde) über deren eigenes Online-Meldeformular. Die BfDI ist nur für Bundesbehörden sowie für Telekommunikations- und Postdiensteanbieter zuständig. Unmittelbar gilt Art. 33 DSGVO: Meldung unverzüglich und möglichst binnen 72 Stunden nach Bekanntwerden, bei Verspätung mit Begründung. Das nationale Gesetz neben der DSGVO ist das BDSG; die Datenschutzkonferenz (DSK) koordiniert die Auslegung.

Wann müssen wir die betroffenen Personen über eine Datenpanne benachrichtigen?

Wenn die Verletzung voraussichtlich ein hohes Risiko für die Rechte und Freiheiten natürlicher Personen zur Folge hat, müssen Sie nach Art. 34 DSGVO die betroffenen Personen unverzüglich benachrichtigen, zusätzlich zur Meldung an die zuständige Landesaufsichtsbehörde nach Art. 33. Die Benachrichtigung muss in klarer und einfacher Sprache die Art der Verletzung, die wahrscheinlichen Folgen und die ergriffenen Maßnahmen beschreiben.

À qui et dans quel délai devons-nous notifier une violation de données en France ?

En France, l'autorité de contrôle est la CNIL. Vous notifiez une violation de données à caractère personnel à la CNIL via son téléservice dédié (notifications.cnil.fr), réservé aux responsables de traitement. L'article 33 du RGPD s'applique : la notification initiale doit intervenir dans les meilleurs délais et, si possible, dans les 72 heures suivant la prise de connaissance de la violation (avec justification en cas de dépassement), sauf si la violation n'est pas susceptible d'engendrer un risque pour les droits et libertés. La loi nationale articulée avec le RGPD est la loi Informatique et Libertés (loi n° 78-17 du 6 janvier 1978). Le responsable de traitement doit également tenir un registre interne de toutes les violations.

Quand devons-nous informer les personnes concernées d'une violation ?

Lorsque la violation est susceptible d'engendrer un risque élevé pour les droits et libertés des personnes, l'article 34 du RGPD impose d'en informer les personnes concernées dans les meilleurs délais, en complément de la notification à la CNIL. La communication doit décrire, en des termes clairs et simples, la nature de la violation, ses conséquences probables et les mesures prises.

Bij wie en binnen welke termijn moeten wij een datalek in Nederland melden?

In Nederland is de Autoriteit Persoonsgegevens (AP) de toezichthouder. U meldt een datalek bij de AP via het online meldformulier datalekken (datalekken.autoriteitpersoonsgegevens.nl). Artikel 33 AVG geldt rechtstreeks: meld zonder onredelijke vertraging en zo mogelijk binnen 72 uur na ontdekking, met een motivering wanneer het later is, tenzij het datalek waarschijnlijk geen risico voor de rechten en vrijheden van betrokkenen oplevert. De nationale wet naast de AVG is de Uitvoeringswet AVG (UAVG).

Wanneer moeten wij de betrokkenen over een datalek informeren?

Als het datalek waarschijnlijk een hoog risico voor de rechten en vrijheden van personen oplevert, moet u op grond van artikel 34 AVG de betrokkenen zonder onredelijke vertraging informeren, naast de melding aan de AP. De mededeling moet in duidelijke en eenvoudige taal de aard van het datalek, de waarschijnlijke gevolgen en de genomen maatregelen beschrijven.