The 72 hours start when you notice, not when you fix it

An email goes out at 16:40 with the wrong client’s file attached. At 16:52 you read the recipient’s name properly and your stomach drops. The clock started at 16:52.

That is the part firms get wrong. Article 33 of the UK GDPR sets the deadline running “after having become aware of it” (legislation.gov.uk, checked 11 September 2026). Not after you recall the message. Not after the recipient replies saying they deleted it. Not after you decide whether it counts. Awareness starts it, and everything you do next happens inside it.

Here is the procedure. Read it now, while nothing has gone wrong, because the version you invent at 16:53 will be worse.

1. Record the minute you became aware

Write the time down, in writing, somewhere that is not your own memory. Everything after this is measured from it.

The check: are you recording when you noticed, or when you understood? If it genuinely takes an hour to confirm what was attached, take the hour and record that you took it and why. What you cannot do is defer the clock by declining to look.

2. Contain it, and assume containment changes nothing

Ring the recipient. Ask them to delete it without opening it, and to confirm in writing that they have. Assume you cannot unsend anything.

The decision: none, yet. This step does not stop the clock and does not answer any question below. A wrong recipient who deletes the file and confirms it has still received it. Do it because it reduces the harm, not because it closes the incident.

3. Write down what actually left

Before you can assess anything you need four facts: whose personal data, what categories of it, roughly how many people, and who received it. Article 33(3) requires exactly this in any report — the nature of the breach, the approximate numbers of data subjects and records, the likely consequences, and what you have done about it.

The check: can you name the categories specifically? “A client file” is not an answer. Bank statements, a passport scan, a medical note and a change of address are four very different risks.

4. Test one — a likely risk means the ICO

The ICO defines a personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data” (ICO, Personal data breaches: a guide, checked 11 September 2026). Note “accidental”. There is no carve-out for meaning well.

The test is whether the breach is likely to result in a risk to the rights and freedoms of the people involved. Read the wording of Article 33(1) carefully: you notify unless the breach is unlikely to result in a risk. The default sits on the reporting side, and the exemption is the thing you have to be able to argue.

The decision: risk likely, or not. Make it inside 72 hours — including evenings and weekends, since the regulation counts hours, not working days.

5. Test two — a high risk means the person

This is a separate test with a different threshold, and firms routinely collapse the two. Article 34 requires you to tell the individual only where the breach is likely to result in a high risk to their rights and freedoms. High risk is the stricter bar. Clearing test one does not automatically trigger test two.

Article 34(3) sets out where even a high-risk breach need not be communicated: where the data was protected by measures such as encryption that render it unintelligible to the recipient, where you have since taken measures ensuring the high risk is no longer likely to materialise, or where individual contact would take disproportionate effort and a public communication will do.

The check: if you are relying on the encryption exemption, did the same email carry the password?

6. Report in phases rather than miss the deadline

Incomplete information is not a reason to run past 72 hours. Article 33(4) allows the information to be provided in phases “without undue further delay”. A late report must be accompanied by reasons for the delay — so the choice is never “report late or report thin”, it is “report what you have and follow up”.

7. Log it even when you report nothing

Article 33(5) requires you to document any personal data breach — the facts, its effects, and the remedial action taken. Any. Including the ones you assessed and decided not to report.

That record is the whole defence of a decision not to notify. Without it you are a firm that did not report; with it you are a firm that assessed and concluded. The two look identical until someone asks.

The check: do you know, today, which file that record goes in and who writes it?

---

One thing this post will not do is tell you whether your incident is notifiable. That assessment is yours, it turns on facts only you have, and the wrong call in either direction has consequences. If it is borderline — and misdirected email frequently is — ring the ICO helpline or speak to a solicitor, and do it on day one rather than day three.

What you can settle in advance is the machinery: who makes the call when the owner is on a train, where the log lives, and the two sentences above written somewhere you will find them. Risk means tell the ICO. High risk means tell the person. Ten minutes now, and the worst hour of someone’s quarter becomes a procedure instead of a panic.