A data breach investigation is one of the most time-pressured and legally complex exercises a business can face. Under UK GDPR, a personal data breach that is likely to result in a risk to the rights and freedoms of individuals must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where the risk is high, the affected individuals must also be notified without undue delay. Those obligations apply from the moment of awareness, not from the moment the investigation is complete.
Managing this pressure requires a structured incident response process that runs the investigation and the notification assessment in parallel, that preserves the evidence needed for regulatory proceedings while restoring operations, and that produces the kind of documented, evidentially sound findings that the ICO expects to receive in a breach notification and that will be scrutinised if a formal investigation follows.
What Is a Data Breach?
Under UK GDPR, a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The definition is deliberately broad. It covers external attacks that result in data being accessed or exfiltrated; internal incidents where data is accidentally sent to the wrong recipient; ransomware attacks that encrypt data and render it unavailable; and physical incidents such as lost or stolen devices containing personal data.
Not every breach must be reported. The reporting obligation is triggered where the breach is likely to result in a risk to the rights and freedoms of individuals — a threshold that requires a risk assessment of the specific breach, taking account of the categories of data involved, the sensitivity of the data, the number of individuals affected, and the likely consequences of the breach for those individuals.
Incident Response Process
The incident response process for a data breach follows a structured sequence that must begin immediately on awareness of the potential breach. Time elapsed from awareness is the most critical variable: it affects both the regulatory notification window and the ability to contain the breach before further harm occurs.
Immediate identification and classification: establishing what type of incident has occurred, what data may be involved, and what systems are affected. This first assessment is necessarily rapid and may be incomplete, but it provides the basis for the initial notification assessment.
Containment: stopping the ongoing breach from causing further harm. For a ransomware attack, this means isolating affected systems. For a phishing-enabled account compromise, this means revoking the compromised credentials. For an inadvertent disclosure, this means recalling the disclosure where possible and contacting the unintended recipient.
Initial notification assessment: a rapid assessment of whether the 72-hour notification obligation is triggered, based on the available information about the nature, scope, and likely consequences of the breach. This assessment will be updated as the investigation progresses.
Evidence preservation: securing the logs, system states, and other evidence needed for the forensic investigation, before remediation steps that might overwrite or destroy that evidence are taken.
Forensic investigation: a thorough investigation of how the breach occurred, what was accessed or exfiltrated, who was responsible, and what the full scope of the breach is. This investigation informs both the regulatory notification and the remediation programme.
Forensic Investigation
The forensic investigation of a data breach establishes the facts that the regulatory notification requires and that any subsequent regulatory investigation will scrutinise. The investigation must be thorough, documented, and conducted in a manner that preserves the integrity of the evidence gathered.
Initial access investigation: establishing how the attacker or the unauthorised disclosure gained access to the affected data. This is the most important factual finding for both the regulatory narrative and the remediation programme: understanding the initial access vector is the prerequisite for preventing a repeat.
Scope determination: establishing the full scope of the breach — which data categories were involved, how many individuals are affected, what period the breach covers, and whether any data was exfiltrated or only accessed. Scope determination requires analysis of the available logs and, where necessary, forensic examination of affected systems.
Timeline reconstruction: establishing the timeline of the breach — when initial access occurred, when the breach became operational, when it was detected, and what happened in the intervening period. The timeline is a central element of the regulatory notification and provides the context for assessing the breach’s severity.
Data mapping: where the affected systems contain multiple categories of data relating to multiple categories of individuals, a detailed mapping of which data was accessible in the affected system, what security controls were applied to it, and which categories were specifically accessed or exfiltrated.
Root Cause Analysis
Root cause analysis is the investigative step that transforms a breach investigation from a reactive exercise into a proactive one. It establishes not just what happened but why — which vulnerability was exploited, which control failed, and which process or configuration weakness created the conditions for the breach.
The root causes most commonly identified in data breach investigations are: unpatched software vulnerabilities exploited by external attackers; phishing attacks that succeeded because multi-factor authentication was not enabled; misconfigured cloud storage that made data publicly accessible; credential compromise enabled by weak or reused passwords; and insider threat incidents enabled by excessive access rights not calibrated to the principle of least privilege.
The root cause finding directly informs the remediation programme: each identified root cause should have a corresponding remediation measure, and the remediation programme should demonstrate to the ICO that the organisation has taken steps to prevent a recurrence. An ICO investigation that finds a breach has recurred because the root cause was not identified and remediated in the first instance is likely to view the organisation’s response more critically.
Regulatory Reporting
The UK GDPR breach notification to the ICO must be made within 72 hours of the organisation becoming aware of a reportable breach. The notification form requires the organisation to provide: a description of the nature of the breach; the categories and approximate number of individuals concerned; the categories and approximate number of personal data records concerned; the name and contact details of the data protection officer; a description of the likely consequences of the breach; and a description of the measures taken or proposed to address the breach.
Where the full picture is not available within 72 hours — which is often the case, given the time pressure involved — it is permissible to submit an initial notification within the window and to provide additional information in subsequent updates. The ICO expects this and has provided guidance on the phased notification approach. What is not acceptable is to delay the initial notification beyond 72 hours because the investigation is incomplete.
Where the breach is likely to result in a high risk to individuals — because sensitive data categories are involved, because the data can be used for identity fraud, or because the number of affected individuals is large — the organisation must also notify the affected individuals without undue delay, providing them with information about the breach and the steps they can take to protect themselves.
Investigating a data breach and need forensic support? Contact iSpy Detectives for expert data breach investigation services. Our detectives have recently undertaken Date Breach Investigations for business customers in London, Manchester, Dundee, Birmingham, Liverpool, Cardiff, Rochester and Lincoln.