What actually counts as a reportable data breach?

Under UK GDPR, a breach is reportable to the ICO if it's likely to result in a risk to people's rights and freedoms — not every lost laptop or misdirected email automatically qualifies, but you must assess and document that decision either way, usually within 72 hours of becoming aware. Keep an internal breach log even for incidents you decide not to report, since you may need to show you considered it properly.

Coach's tip: work out your reporting process before an incident happens — deciding it during a real breach wastes precious hours of the 72-hour window.