If you experience a personal data breach, our self-assessment tool will help you consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report it to the ICO. 

You can find the tool in the self-serve section on the home page of our website here: ico.org.uk/sme

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.