Loading…
Sources: European Data Protection Board, members and European Commission, adequacy decisions, checked 2026-09-17.
Who has to be told and how long you have, from the regimes that reach United Kingdom. Each row keeps the article it comes from, so it can be checked rather than believed. Whether a regime reaches a particular company is a question for someone who knows it.
Personal data breach likely to result in a risk to individuals
Without a fixed clock
| Who | Within | When it starts |
|---|---|---|
| Information Commissioner's Office (ICO) | 72 hours | Personal data breach likely to result in a risk to individuals |
| Affected individuals | Without undue delay | Personal data breach likely to result in a high risk to individuals |
| Who | How long | When it applies | Where it says so |
|---|---|---|---|
| Information Commissioner's Office (ICO) | 72 hours | Personal data breach likely to result in a risk to individuals | Art. 33 UK GDPR |
| Affected individuals | Without undue delay | Personal data breach likely to result in a high risk to individuals | Art. 34 UK GDPR |
The regimes that apply here and the guides that answer what this page raises, worked out from what we have written.