Personal data breach in the UK: what to do, a complete guide

Hearing that your personal information was caught up in a breach is unsettling. The Information Commissioner's Office (ICO), the UK regulator for data protection, acknowledges this directly: it is natural to want to know what has happened to your information, and a breach can be upsetting or overwhelming. This guide gathers the advice of two public bodies, the ICO and the National Cyber Security Centre (NCSC), into one calm, ordered plan.

It stays strictly within three of their pages: the ICO page on the steps you can take if you have been affected by a personal data breach, the NCSC page on hacked accounts, and the NCSC page on choosing passwords with three random words. Where those pages say nothing on a point, we say so instead of filling the gap. Nothing here can tell you whether you are personally affected by a given breach, and no step below comes with a promised result.

What to do first

If you have just learned of a breach, or suspect one, this is the order the sources point to. Each step is explained in the sections that follow.

1. Ask the organisation what happened. The ICO says you can ask it to explain what has happened, what information has been affected and what it plans to do to protect your information.
2. Check your money. Look at your bank statements and get a copy of your credit report, looking for anything you do not recognise.
3. Treat unexpected contact with suspicion. Be wary of phone calls, emails, text messages and websites, because criminals can use breached information to impersonate organisations you trust.
4. Strengthen your passwords and turn on extra checks. Use strong passwords, and multifactor authentication where it is offered.
5. If an account is hacked, act on it at once. Contact the provider, check your email filters, change passwords, log out of all devices and set up 2-step verification.
6. Keep a record of every contact. The ICO asks you to note who you spoke to and when, and to follow up in writing where possible.

If something has already gone wrong with your safety or your money, skip ahead to the sections on protecting yourself and on reporting.

Understanding what has happened

The ICO's page opens from the point of view of someone who has either been told about a personal data breach by an organisation or discovered one themselves. In both cases, the first practical need is information: which of your details were involved, how, and what is being done about it.

The organisation is the first place to ask

The ICO is clear that you can complain to the organisation and ask it to explain three things:

• what has happened;
• what information has been affected; and
• what steps it plans to take to protect your information.

It adds that organisations need a process to deal with data protection complaints, and that many concerns can be resolved quickly and effectively this way. The ICO also points to its separate advice on how to make a data protection complaint, which includes a template. That page is not one of the sources of this guide, so the details are not repeated here.

What the organisation should be able to tell you

According to the ICO, the organisation should be able to do three further things:

• confirm whether your information was involved;
• acknowledge how this affected you; and
• advise on what further steps you can take.

This matters if you are unsure whether you are among the people concerned. The ICO's guidance is that the organisation is the party able to confirm it. A public tool can only look at what is publicly known, so a clean result from any search is not a statement that your details were never exposed.

Time limits you can expect

The organisation has 30 days to acknowledge your complaint. The ICO says it also needs to investigate what happened, keep you informed about progress, and provide you with an outcome without unjustified delay.

The page is realistic about timing. It says it may take some time for the organisation to look into what has happened, and that you should not be afraid to chase politely if you hear nothing within 30 days. It does not set a deadline for the final outcome.

Keep a record

The ICO's advice on records is specific. Try to keep a record of any contact you have had with the organisation. If you speak to them by phone, make a note of who you spoke to and when, and follow this up in writing where possible.

Protecting yourself after a breach

The ICO observes that hackers sometimes share personal information online after a breach, and that criminals can use it to scam people. It then lists simple steps to protect yourself from harm and disruption. They are set out below in the ICO's own order.

Report lost or stolen documents

If details of documents such as passports, driving licences, credit cards or cheque books have been lost or stolen, report them to the organisation that issued them. The ICO does not describe what each issuer will do next, so the reporting route is the issuer's own.

Check your bank statements and credit report

Check your bank statements and get a copy of your credit report. Look for any transactions, accounts or activity that you do not recognise. If you spot anything unusual, contact your bank, building society or credit card company.

The ICO does not specify how often to check, nor which credit reference agency to use. It simply asks you to look for what you do not recognise and to contact your provider promptly if you find it.

Watch for suspicious calls, emails, texts and websites

The ICO warns that criminals can use information from breaches to impersonate trusted organisations, such as your bank or HMRC. They may contact you with calls or messages that sound convincing, so you should watch out for any suspicious phone calls, emails, text messages and websites.

If you are unsure whether a call from your bank is genuine, the ICO gives practical options:

• hang up and call the number on the back of your card;
• use your bank's app or website; or
• if your bank supports it, call 159 to be connected safely to your bank.

The ICO adds that the NCSC and the Financial Conduct Authority (FCA) have more information on how to recognise and protect yourself from scams. The ICO page itself does not go further than this on scams, so this guide does not either. It does not describe particular scam types or give a method for spotting them.

Use strong passwords and multifactor authentication

The ICO recommends strong passwords, and multifactor authentication if it is available, to protect your accounts. It points to its own video on simple steps to protect your information from cyber criminals. The next two sections turn to the NCSC for what a strong password looks like and what to do if an account falls into the wrong hands.

Consider protective registration with Cifas

The ICO also mentions Cifas, described as the UK's Fraud Prevention Service. You can apply to it for protective registration. This places a warning flag against your name and other personal details on its National Fraud Database. The flag tells any organisation that uses Cifas information to pay special attention when your details are used to apply for their products or services.

The ICO states plainly that there is a fee to use this service. Knowing that you are at risk, organisations will carry out extra checks to make sure it is really you applying and not a fraudster using your details. If you are concerned, the ICO says it has put together information about identity theft to help. That information is not part of the sources here.

When a breach threatens your safety or wellbeing

The ICO takes a broader view of harm than money. It says personal data breaches can sometimes cause harm and may put your health or wellbeing at risk, including through discrimination, abuse or serious distress.

If you are concerned for your safety, contact the police for information and support. If you do not feel able to do that, or would prefer another form of support, the ICO says it has put together a list of organisations that can help. According to the ICO it includes specialist charities, helplines and services that offer confidential advice and practical help.

Choosing strong passwords: three random words

A breach often leads people to change passwords. The NCSC has a clear view on how to choose them, and it differs from older habits.

The basic idea

The NCSC says weak passwords can be cracked in seconds, and that the longer and more unusual your password is, the harder it is for a cyber criminal to crack. Its suggested method is to combine three random words to create a password that is long enough and strong enough. Its example is applenemobiro. The alternative is a password manager, which can create strong passwords for you and remember them.

What to avoid

The NCSC lists the passwords criminals can easily guess:

• the most common passwords, such as "password";
• passwords built from significant dates, like your birthday or a loved one's;
• passwords based on your favourite sports team;
• family and pet names.

It explains the reasoning: most of these details can be found within your social media profile.

It also addresses a common trick. If you are thinking of swapping certain characters, for example the letter "o" for a zero, the NCSC says cyber criminals know these tricks as well. Your password will not be significantly stronger, but it will be harder for you to remember.

Why the NCSC recommends three random words

The NCSC's argument is about people, not only machines. By using three random words, you create a password that is strong enough to keep criminals out and easy enough for you to remember. It describes the longstanding advice to fill passwords with random characters, symbols and numbers as not helpful. The reason it gives is that most of us have many passwords, and memorising lots of complex ones is almost impossible.

The method also helps you keep passwords unique. The NCSC says passwords generated from three random words are a good way to create unique passwords that are long enough and strong enough for most purposes but can be remembered much more easily.

Writing a password down

The NCSC says that if you want to write your password down, that is also fine, provided you keep it somewhere safe. The page does not say what counts as a safe place beyond that.

If an account has been hacked

The NCSC page on hacked accounts is aimed at anyone who has lost access to an account or noticed unusual activity. It sets out a series of actions. They are listed here in the NCSC's order.

Contact your account provider

Go to your account provider's website and search its help or support pages. The NCSC says they should explain the account recovery process in detail. The recovery steps differ between services, and the NCSC page does not list them for individual providers.

Check your email account

Check your email filters and forwarding rules. The NCSC explains that cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, which could allow them to reset your passwords. Look for information on how to check this on your email provider's website.

Change passwords

Immediately change the password for the hacked account. The NCSC adds that it is also important to change the password for any other accounts where you use the same password. Its reason is that cyber criminals know people often use the same password for different accounts, so they will try the hacked password across multiple accounts. Use a strong and unique password, such as three random words.

Log out of all devices and apps

After you have changed your passwords, make sure you log out of the account on any devices and apps. You can usually do this in the settings menus of the app or website, or if you cannot find it there, in the privacy or account options. The NCSC says this means a cyber criminal will not be able to use your old password to access your account.

Set up 2-step verification

Many online accounts and services let you set up 2-step verification (2SV). The NCSC says this adds an extra layer of security, so that even if a criminal knows your password, they will not be able to access your account. It usually works by sending you a PIN or code, usually by SMS or email, which you then enter to prove it is really you.

Update apps and devices

Update your apps and devices as soon as updates are available. The NCSC says installing security updates gives you protection and often brings improvements and new features. It describes installing updates as one of the most important things you can do to prevent your account from being hacked, and suggests turning on automatic updates in your device settings so you do not have to remember.

Tell your contacts

Get in touch with contacts, friends or followers linked to the hacked account. Tell them you were hacked and warn them to be suspicious of any recent messages sent from your account. The NCSC says this will help them avoid being hacked themselves.

Check your bank statements and online store accounts

A hacked email account can lead to hacks elsewhere, according to the NCSC. Look out for unauthorised purchases and check your bank accounts for unusual transactions. It also advises contacting your bank directly for further support, using the contact details from its official website or social media channels to make sure they are genuine.

Report it

If you have lost money, tell your bank straight away and report it to Report Fraud or, in Scotland, contact Police Scotland. The NCSC page adds that organisations in the UK that have experienced a cyber incident can report it. That is aimed at organisations rather than individuals.

If you cannot recover the account

The NCSC acknowledges that sometimes it will not be possible to recover your account using the online service. In that case you will have to create a new account if you want to continue using the service.

The NCSC then lists what to do next. It is important to give contacts your new details and tell them you are no longer using the old account. Make sure you update any bank, supplier or store websites with your new details.

For further reading the NCSC points to its guidance on recovering a hacked account (a step by step guide), on protecting what you publish on social media, and on setting up 2-step verification. Those pages are outside the sources used in this guide.

Complaining to the ICO

The ICO's page ends with how it can help. It says its aim is to help you understand the steps you can take to protect your information and to help you decide whether complaining to the ICO is right for you.

When you can complain

You can make a complaint to the ICO if an organisation has not kept your information safe. The ICO recommends giving the organisation an opportunity to investigate and respond first. In its words, this may resolve your concerns and help the ICO handle your complaint more quickly if you remain unhappy with the organisation's response.

How to do it

If you decide to complain to the ICO, its data protection complaints page explains what information you need to provide and how to submit it. You can make a complaint online, in your own time. For more on how it handles complaints, the ICO points to its data protection complaints handling framework and harm examples.

What the ICO page does not cover

The page does not discuss compensation, and it does not say how long an ICO complaint takes. The sources used here do not explain either, so we do not guess. If these points matter to you, read the ICO pages directly.

What the sources do not say

A fair guide lists its limits. The three pages used here do not cover the following, and this guide does not claim they do:

• phishing or identity theft as subjects in their own right. The ICO only mentions impersonation by criminals and offers its identity theft information through a link;
• how to find out whether your details appear in a particular breach, other than asking the organisation;
• which companies or services were breached, or how to tell a genuine breach notice from a fake one;
• what a particular provider's account recovery process looks like;
• what happens to your information after it has been shared online by hackers, or whether it can be taken down.

The ICO and the NCSC link to further pages on some of these subjects. Use those for detail, and treat any outcome as uncertain.

Where a free scan fits

Remove Me offers a free scan with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (through Have I Been Pwned) and a register of data brokers, then shows a report. The report is unlocked with a 6-digit code sent by e-mail.

The scan only searches what is publicly known. It cannot tell you that a breach did not involve you, and it cannot replace asking an organisation, which the ICO says should be able to confirm whether your information was involved. Remove Me does not yet send erasure requests on your behalf. What it can do is give you a clearer picture of what is already visible, so you can decide which of the steps above to take first.