Is losing access to our own files actually a data breach?

Yes. A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data — so losing access to your own files is on the list, even though nothing left the building (ICO, Personal data breaches: a guide, checked 14 September 2026).

That definition has three limbs, not one. Confidentiality — someone saw data who shouldn’t have. Integrity — data was altered when it shouldn’t have been. Availability — data was destroyed or lost, permanently or temporarily. Most firms triage on the first limb only, because disclosure is the one that feels like a scandal. The ICO guidance is explicit that a breach can be deliberate or accidental, and that it covers loss of availability.

So the ransomware case that locks your files and takes nothing is still within the definition. So is the bookkeeper who overwrites a client ledger with the wrong figures. So is the backup that silently stopped running eighteen months ago, discovered the week you need it.

What this means for your incident log

It means the log has to catch the dull incidents, not only the alarming ones. A wrong attachment gets logged because it is obviously embarrassing. A two-day outage that left you unable to answer a client’s access request often does not get logged at all, and on the definition it belongs there.

None of this tells you whether a given incident at your firm is reportable — that depends on the risk to the people involved, which is a separate assessment, and the ICO’s guide sets out how it works. What it does tell you is where to start. Run each incident against all three limbs before deciding it was nothing.

Five worth testing against the definition, because they are the ones small firms actually have: the lost laptop, the email to the wrong client, the bin bag of printouts, the ransomware lockout with no exfiltration, and the file someone edited and saved over. Two of those are disclosure. The rest are not, and they count anyway.