In the Middle of a Data Breach? Get Help Now

Stay calm and contain it
If you can safely stop the breach from getting worse (e.g. revoke access, isolate a system, recall an email), do so now. Don't take drastic action that could destroy evidence.

Don't delete anything
Avoid deleting emails, logs, or files related to the incident, even if it feels like the instinctive thing to do. This information is often essential for understanding what happened and demonstrating your response.

Note the time and details
Write down when you discovered the breach, how you discovered it, and what you know so far. The clock on regulatory reporting starts from when you became aware, so this timestamp matters.

Don't notify the ICO yet, talk to us first
You may have a legal duty to report certain breaches to the ICO within 72 hours, but not every incident meets that threshold. Get advice before you report, so you report accurately, and only if you need to.

Limit who knows, for now
Avoid broad internal announcements or public statements until you understand the scope. Loop in only the people who need to be involved in the immediate response.