Skip to main content
Home

Report a data security breach

Latest updates - 20 August 2025

20 August 2025 - the form was updated. The Data Use and Access Act changes the reporting timescales for breach reports under PECR. It changes from 24 hours to 72 hours after becoming aware of the breach.

What information are you providing?

If there have been personal data breaches, please attach your completed breach log below. If there have not been any personal data breaches during this month, you can email a 'nil return' to [email protected]. As nil returns do not need to be sent securely, you do not need to use this form.

We accept Excel, Word and Open Office spreadsheet and document files, CSVs and text-based files. Maximum of 3 MB.

Use this form for the first notification within 72 hours of detecting a breach.

When did this breach occur?

On or between ...
... and
When was the breach first detected?

You should provide the following information now, if possible. If not, you must send a second notification form within three days.

You should have already sent an initial notification with as much information as possible. Please now provide further detail. For each question, please add any further details since your initial notification. Please tell us if any details have changed. If you cannot provide any of the information we ask for now, you should explain why, and send a follow up form as soon as possible.

You should have already sent an initial notification and second notification with as much information as possible. Please now provide any further remaining details.

When did this incident occur?

On or between ...
... and
Did the breach occur in response to a Regulation of Investigatory Powers Act request?
Have you provided all the information we have asked for?
We accept Word, Excel and other MS Office and Open Office files, image files, and text files. Up to 2 MB per file
Address