What to do after a personal data breach in the UK: ICO steps

You have had an email or a letter saying your data was part of a breach, or you have found out some other way. It is natural to want to know what has happened to your personal information. The Information Commissioner's Office (ICO) acknowledges that personal data breaches can affect people in different ways and may be upsetting or overwhelming. This guide follows the ICO's page for the public and puts its advice in order, without adding anything to it.

Step 1: ask the organisation what happened

You can complain to the organisation and ask it to explain:

• what has happened,
• what information has been affected, and
• what steps it plans to take to protect your information.

The ICO says organisations need to have a process to deal with data protection complaints, and that many concerns can be resolved quickly and effectively this way. It also points to its own advice on making a data protection complaint, which includes a useful template.

Step 2: know what to expect, and keep records

According to the ICO, the organisation has 30 days to acknowledge your complaint. It also needs to investigate what happened, keep you informed about progress and give you an outcome without an unjustified delay.

The ICO says the organisation should be able to:

• confirm if your information was involved,
• acknowledge how this affected you, and
• advise on what further steps you can take.

Keep a record of any contact you have with the organisation. If you speak to them by phone, note who you spoke to and when, and follow it up in writing where possible. It may take some time for the organisation to look into what has happened. The ICO says not to be afraid to chase politely if you do not hear anything within 30 days.

Step 3: if you feel unsafe

The ICO says personal data breaches can sometimes cause harm and may put your health or wellbeing at risk, including through discrimination, abuse or serious distress. If you are concerned for your safety, it says to contact the police for information and support. If you do not feel able to do that or would prefer another form of support, the ICO has put together a list of organisations that offer support, including specialist charities, helplines and services offering confidential advice and practical help. The page does not name them, so look for that list on the ICO site.

Step 4: protect yourself from misuse of your details

The ICO notes that hackers sometimes share personal information online after a breach, and criminals can use it to scam people. It suggests some simple steps.

Lost or stolen documents

Report details of lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them.

Bank statements and credit report

Check your bank statements and get a copy of your credit report. Look for any transactions, accounts or activity you do not recognise. If you spot anything unusual, contact your bank, building society or credit card company.

If you want to see what is publicly visible about you, Remove Me offers a free analysis with no account needed. It searches publicly visible web results, known public data breaches (Have I Been Pwned) and a register of data brokers, then shows a report unlocked with a 6-digit code sent by e-mail. Remove Me does not yet send erasure requests on your behalf.

Suspicious calls, emails and texts

Watch out for suspicious phone calls, emails, text messages and websites. The ICO says criminals can use information from data breaches to impersonate trusted organisations, such as your bank or HMRC, to contact you with convincing calls or messages.

If you are unsure whether a call from your bank is genuine, the ICO's advice is to hang up and call the number on the back of your card, or use your bank's app or website. If your bank supports it, you can call 159 to be connected safely to your bank. The ICO says the National Cyber Security Centre (NCSC) and the Financial Conduct Authority (FCA) have more information on how to recognise and protect yourself from scams.

Passwords and multifactor authentication

Use strong passwords, and multifactor authentication if it is available, to protect your accounts. The ICO points to a video of simple steps to protect your information from cyber criminals.

Cifas protective registration

You can contact Cifas, which the ICO describes as the UK's Fraud Prevention Service, to apply for protective registration. This places a warning flag against your name and other personal details on its National Fraud Database. It tells any organisation that uses Cifas information to pay special attention when your details are used to apply for their products or services. Knowing you are at risk, organisations will carry out extra checks to make sure it is really you applying. The ICO states there is a fee to use this service, and does not give the amount. It also offers information about identity theft if you are concerned.

Step 5: complain to the ICO if you need to

You can make a complaint to the ICO if an organisation has not kept your information safe. The ICO recommends giving the organisation an opportunity to investigate and respond first. This may resolve your concerns and help the ICO handle your complaint more quickly if you remain unhappy.

If you decide to complain, the ICO's data protection complaints page explains what information you need to provide and how to submit it. You can complain online, in your own time. The ICO also publishes a complaints handling framework and harm examples, which are not covered in the page used for this article.

What this page does not tell you

To keep this guide accurate, here is what the ICO page does not say:

• It does not say how you can find out whether your details appear in a particular leaked file.
• It does not give a list of which organisations are affected by any named breach.
• It does not say how long the organisation's full investigation will take, only that the outcome should come without unjustified delay.

Nothing here is a promise about what a complaint will achieve. It is a summary of the steps the ICO suggests.

In short

• Ask the organisation what happened, what was affected and what it will do.
• Expect an acknowledgement within 30 days, and keep your own record of every contact.
• Check bank statements and your credit report, and be wary of calls, emails and texts.
• Use strong passwords and multifactor authentication where you can.
• Complain to the ICO if you remain unhappy after giving the organisation the chance to respond.

The Remove Me team.