Notifying a personal data breach is the start of the regulator's involvement, not the end: what follows can be weeks or months of information requests, evidence reviews, interviews and, at worst, a notice of intent to fine. How an organisation handles that phase shapes the outcome as much as the breach itself, because the law tells regulators to weigh cooperation, mitigation and the measures that were in place. This guide covers how an inquiry arrives, the triage questions to answer in the first days, how to control the response, the evidence pack regulators expect, remediation commitments, the penalty process and appeal rights, and the deadlines inside each stage. It uses the UK regime as the worked example, with the EU GDPR equivalents where the articles match, and is written for data protection officers, general counsel, CISOs and incident leads. Filing the original notification is covered in the Data Breach Notification Checklist; this guide starts after it.
A note on names: on 30 September 2026 the Information Commission took over the functions of the Information Commissioner's Office (ICO) as the UK data protection regulator. The government announcement says the regulator's role, responsibilities and powers did not change. This guide says "the regulator" or "the Commission", and "ICO" only where referring to existing ICO material.
Key takeaways
- Treat the first letter as a legal deadline. Formal notices carry statutory timings and appeal rights, and failing to comply with an information, assessment, interview or enforcement notice attracts the higher maximum penalty under the Data Protection Act 2018.
- One owner, one version of the facts. Inconsistent answers across the notification, the inquiry and public statements damage credibility faster than the breach does.
- Evidence of measures beats statements of intent. Article 83(2) tells regulators to weigh the technical and organisational measures in place, the steps taken to mitigate harm and cooperation, so prove each with documents.
- Privilege has statutory limits. The Act protects legal advice on data protection obligations and communications for proceedings, but not operational facts, so plan how forensic reports are commissioned and shared.
- Remediation commitments are monitored. Promise only dated actions you can deliver, track them visibly, and report progress before you are asked.
How the incident shows up
The regulator's next step after a breach report arrives in one of a few forms. Recognise which one you have, because the legal weight and deadlines differ.
| What arrives | Legal basis (UK) | Timing rules | What it means |
|---|---|---|---|
| Informal letter or email asking questions about the breach report | Regulator's general functions; UK GDPR Article 58(1) investigative powers | Deadline set in the letter | The most common route; cooperation here is weighed later under Article 83(2)(f) |
| Information notice | DPA 2018 section 142 | Compliance cannot be required before the appeal period ends and is paused by an appeal; if the notice states urgency with reasons, not earlier than 24 hours after it is given | Formal requirement for information or documents (documents expressly included since 19 August 2025) |
| Assessment notice | DPA 2018 section 146 | As set in the notice | Audit-style access to premises, systems and people; since the Data (Use and Access) Act 2025 it can require you to commission and pay for a report to the regulator's specification |
| Interview notice | DPA 2018 section 148A (in force 5 February 2026) | Attendance not required before the appeal period ends; if urgent, not within 24 hours of the notice | Current or former staff and managers can be required to answer questions; knowingly or recklessly false statements are an offence |
| Notice of intent | DPA 2018 Schedule 16 | At least 21 days for written representations | The regulator proposes a penalty and amount; your main chance to change the outcome |
| Enforcement notice, reprimand or penalty notice | DPA 2018 sections 149 and 155; UK GDPR Article 58(2) | Penalty payable in not less than 28 days | The outcome; appealable to the Tribunal |
In the EU, the same Article 58 powers sit with each supervisory authority, and cross-border cases are led by the lead supervisory authority. The GDPR Procedural Regulation guide covers how cross-border procedure is changing.
Triage questions
- What exactly has been received? An informal inquiry or a statutory notice? Which section is cited? What is the deadline and the appeal period?
- Who is the addressee? The controller, a processor, a representative or a named individual (interview notices can name former employees).
- What does the regulator already know? Re-read your breach notification, any follow-up submissions, complaints from data subjects and press coverage, and list every factual statement already made.
- Are the original facts still right? Forensic work since notification often changes record counts, dates or data categories. Article 33(4) allows information in phases, and correcting the record early is better than being found out.
- Is the incident fully contained? The regulator will ask, and an open vulnerability changes the tone of the inquiry.
- Which other authorities are involved? Lead or concerned EU authorities, sector regulators, law enforcement or overseas regulators. Align timing and facts across all of them.
- Is there a privilege strategy? Which reports were commissioned by counsel, and what can be shared without waiving privilege? See the Legal Privilege in Incident Response Guide.
- Is anything in the request genuinely protected? Section 143 excludes legal advice on data protection obligations, communications for data protection proceedings and self-incriminating material (except offences under the Act itself).
Containment priorities
Here, containment means controlling the response so that nothing said or lost makes the position worse.
- Appoint a single response owner. Usually the DPO or general counsel, with authority to collect information from any team and sign off every submission.
- Issue a legal hold. Suspend deletion of logs, tickets, emails, chat messages and backups relating to the incident and to the controls in question. Destroying relevant material after an inquiry starts is very hard to explain.
- Build the master timeline. One document, owned by the response lead, holding every event, decision and statement with a source. Every answer to the regulator is drawn from it.
- Control communication channels. All contact with the regulator goes through the owner. Staff are told not to discuss the inquiry externally, and to pass any direct contact to the owner.
- Check the deadline is achievable. If not, ask the case officer for more time early, with reasons and a proposed date. Do not miss a statutory deadline silently.
- Brief the board. Directors should know the timetable, the possible outcomes and the cost of remediation, because commitments may need their approval.
Eradication
For an inquiry, eradication means removing the root cause in a way you can prove, and turning it into commitments the regulator can rely on.
- Fix root causes, not symptoms. If the breach came from a missing control, such as multi-factor authentication, logging or access review, the remediation plan must address the control across the estate, not only the system that was hit.
- Write remediation as dated, owned actions. For each action give the owner, the completion date, the evidence of completion and the risk it addresses. Vague promises such as "enhance security culture" carry no weight.
- Prioritise by risk to individuals. Order actions by the harm they prevent, and show that the highest-risk gaps were closed first.
- Use independent validation where it helps. An external assessment of the fixed control, or a re-test, strengthens the evidence. Under the 2025 amendments, an assessment notice can require a commissioned report anyway, so a voluntary one may shape the regulator's view.
- Look beyond the breach. Regulators often ask about related obligations, such as records of processing, DPIAs, retention and processor contracts. Fix what an obvious follow-up question would expose.
Recovery
Recovery is the period from your main submission to the outcome, and the follow-up after it.
- Send progress updates on your own initiative. Report completed remediation at the dates you committed to. It demonstrates cooperation under Article 83(2)(f).
- Prepare for a notice of intent. If one arrives, you have at least 21 days for written representations. Use them to correct facts, evidence mitigation and address each aggravating factor the notice lists. Ask for oral representations if the regulator offers them.
- Know the timetable after representations. Since 5 February 2026, the regulator must give a penalty notice, or confirm in writing that it will not, within 6 months of the notice of intent or as soon as reasonably practicable after that.
- Decide on appeal quickly. Section 162 allows appeals to the Tribunal against information, assessment, interview, enforcement and penalty notices, and against the penalty amount alone. Appeal deadlines are short, so take advice as soon as a notice arrives.
- Comply with any enforcement notice in full and on time. Failure to comply with an enforcement notice attracts the higher maximum penalty.
- Close the loop internally. Record the outcome, update policies, and make remediation business as usual so the same finding does not recur.
Evidence to preserve
Build the evidence pack around the factors the regulator must weigh. Article 83(2) lists them; each needs documents, not assertions.
| Article 83(2) factor | What the regulator weighs | Evidence that answers it |
|---|---|---|
| (a) Nature, gravity, duration | Number of people, purpose of processing, harm | Scoping report with record counts and data categories; timeline of exposure |
| (b) Intentional or negligent | Whether the failure was deliberate or careless | Risk assessments and decisions showing the risk was considered |
| (c) Action to mitigate damage | Steps taken for affected people | Notices to individuals, support offered, credential resets, monitoring |
| (d) Degree of responsibility | Technical and organisational measures in place (Articles 25 and 32) | Security policies, control configurations, audit results, training records as they stood before the breach |
| (e) Previous infringements | History with the regulator | Breach log, earlier correspondence and how it was resolved |
| (f) Cooperation | Help given to remedy and mitigate | Response log showing deadlines met and proactive updates |
| (g) Categories of data | Special category or sensitive data | Data inventory and the scoping result |
| (h) How it became known | Whether you notified, and how promptly | Breach notification with timestamps and the awareness record |
| (i) Compliance with earlier orders | Previous measures on the same subject | Evidence those measures were completed |
| (j) Codes of conduct and certification | Adherence to approved schemes | Certificates and audit reports |
| (k) Other factors | Gains made or losses avoided | Financial impact analysis |
Keep the pack as it stood at the time of the breach, separate from later improvements, so you can show both what was in place and what changed. Logs are often the weakest point: the joint UK and Canadian findings on the 23andMe Breach 2023 recorded that logging was insufficient to detect anomalous user behaviour.
Notification triggers
Several duties continue during an inquiry.
- Updated facts: if the investigation finds more people, more data or a different cause, provide the update to the regulator without undue further delay (Article 33(4) allows phased information) and reassess whether individuals must now be told under Article 34.
- Regulator-ordered notice: Article 58(2) lets the regulator order a controller to communicate a breach to data subjects. If you decided not to notify individuals, document why, because that decision will be tested.
- New breaches: a second breach during an inquiry still needs its own Article 33 assessment and, if notifiable, filing within the 72 hour window.
- Other regulators and disclosures: listed companies, regulated financial firms and essential service operators may have separate reporting or disclosure duties when an investigation or penalty becomes material. See the Breach Notification Laws by Country Guide.
- Insurers and contracts: many policies and client contracts require notice of regulatory proceedings.
Penalty ceilings
| Tier (DPA 2018 section 157) | Undertaking | Examples of what falls in the tier |
|---|---|---|
| Standard maximum | £8,700,000 or 2% of total annual worldwide turnover in the preceding financial year, whichever is higher | UK GDPR Articles 25 to 39 under Article 83(4), which include security (32) and breach notification (33, 34) |
| Higher maximum | £17,500,000 or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher | Principles and lawful basis (Articles 5, 6, 7, 9) and data subject rights under Article 83(5); failure to comply with an information, assessment, interview or enforcement notice |
Ceilings are not starting points. The amount turns on the Article 83(2) factors, which is why the evidence pack matters. Past decisions are summarised in the GDPR Enforcement Decisions on Security Failures Guide and the GDPR Fines and Enforcement Statistics.
Lessons from incidents
The 23andMe Breach 2023 page records a joint investigation by the Office of the Privacy Commissioner of Canada and the UK Information Commissioner, with findings published on 17 June 2025 and a UK fine of £2.31 million that month. The findings centred on customer-side controls: acting on early warning signals, multi-factor authentication and logging able to detect anomalous behaviour. The lesson for an inquiry is that the regulator asks what measures existed before the breach, so the evidence pack and the remediation plan should address authentication, monitoring and alert handling directly.
Framework mapping
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Understand legal and regulatory obligations | GV.OC-03 | IR-8 Incident Response Plan |
| Report to and share information with authorities | RS.CO-02, RS.CO-03 | IR-6 Incident Reporting |
| Establish root cause for the regulator | RS.AN-03 | IR-4 Incident Handling |
| Preserve records under legal hold | RS.AN-03 | AU-11 Audit Record Retention, SI-12 Information Management and Retention |
| Deliver and track remediation | ID.IM-03 | IR-4 |
Common failure patterns
- Answering from memory. Submissions drafted by whoever is available, without a master timeline, contradict the original notification.
- Over-promising remediation. Commitments with unrealistic dates are missed, and the miss becomes a new problem.
- Treating privilege as a blanket. Withholding factual material on privilege grounds that section 143 does not support damages cooperation.
- Letting logs expire. Retention runs out mid-inquiry because no legal hold was issued.
- Ignoring the notice of intent window. Representations are rushed or generic, and the 21 day minimum passes without addressing the specific aggravating factors.
- Forgetting former staff. Interview notices can reach people who have left, so their knowledge and contact details matter.
Practitioner checklist
- Name the regulator response owner and deputy in the incident response plan before any breach occurs.
- Prepare a legal hold template covering logs, tickets, messages, backups and control evidence.
- Keep a master timeline for every notified breach and draw all submissions from it.
- Maintain the evidence pack structure mapped to Article 83(2) factors, with pre-breach controls kept separate from later improvements.
- Log every regulator deadline, its legal basis and appeal period, and track each to completion.
- Write remediation commitments as dated, owned actions with completion evidence, and report progress proactively.
- Agree with counsel how forensic and root cause reports are commissioned and what can be shared.
- Rehearse a regulator inquiry, including a notice of intent response, in a tabletop exercise with legal and the board.
Standards and references
- legislation.gov.uk: Data Protection Act 2018, section 142 Information notices
- legislation.gov.uk: Data Protection Act 2018, section 143 Information notices: restrictions
- legislation.gov.uk: Data Protection Act 2018, section 148A Interview notices
- legislation.gov.uk: Data Protection Act 2018, Schedule 16 Penalties
- legislation.gov.uk: Data Protection Act 2018, section 157 Maximum amount of penalty
- legislation.gov.uk: UK GDPR Article 83, General conditions for imposing administrative fines
- legislation.gov.uk: UK GDPR Article 58, Powers
- GOV.UK: Information Commission succeeds the ICO as UK's data protection regulator
- GOV.UK: Data (Use and Access) Act factsheet, ICO
Related NHI Mgmt Group resources: Data Breach Notification Checklist, Legal Privilege in Incident Response Guide, GDPR Compliance Guide for Security Teams, Accidental Data Disclosure Response Playbook. This guide summarises UK data protection enforcement procedure as of November 2026 and is not legal advice.