Deciding Who to Tell: Breach Notification Governance for UK Boards

Most boards have a plan for the fire. Fewer have a plan for the phone calls that follow it. When a serious cyber incident is confirmed, the organisation faces a sequence of disclosure obligations that run in parallel and on different clocks: the Information Commissioner's Office within seventy-two hours, sector regulators under their own rules, customers under contract terms that are often tighter still, and — for listed companies — the market. Each carries its own test, its own audience and its own penalty regime. Improvising across all four in the same afternoon is how otherwise well-run companies turn a contained technical event into a governance failure.

The clock does not wait for the full picture

Under the UK GDPR, a controller must notify the ICO without undue delay and, where feasible, within seventy-two hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. The pivotal word is aware. Awareness does not require forensic certainty; a credible report from a third party — a customer, the National Cyber Security Centre, a journalist — can start the clock. Boards that assume the timer begins only when the investigation concludes are frequently wrong, and that misunderstanding is expensive.

Two practical points follow. First, notification can be phased: an initial report with the facts then known, followed by supplementary information as the picture resolves, is expressly contemplated. Waiting for completeness is rarely the safer course. Second, the obligation to record breaches applies even where notification is not required, so the decision not to notify must itself be documented and reasoned.

Agree the thresholds before you need them

A board should not be debating whether a given incident is notifiable at three in the morning. The judgement can be reduced to a matrix agreed in calm weather: the categories of data involved, the volume of affected individuals, the sensitivity of the information, the ease of identification, and whether the data has been secured or is in the hands of an adversary. From those inputs the board can define three bands — notify immediately, assess within a fixed window, or log and monitor — and delegate authority accordingly.

Crucially, this matrix should sit alongside a second list of non-ICO obligations, because the data protection analysis is only one of several tests that must be applied.

Name the people, and their deputies

A protocol without names is a document, not a control. The board should designate a single accountable executive for disclosure decisions, typically the chief executive or a formally delegated officer, with a named deputy and an out-of-hours route that is tested rather than assumed. The data protection officer advises but does not decide; the general counsel frames legal risk; the chief information security officer supplies facts; communications drafts; the chief financial officer owns the market question where the company is listed.

Standing authority matters. The board can pre-authorise the filing of an initial ICO notification without convening a full meeting, subject to ratification within a stated period. Without that authority, quorum requirements become a source of delay that no regulator will regard sympathetically.

Keep an evidence pack ready to populate

Regulators do not expect omniscience. They do expect coherence. A pre-built template — timeline, affected systems, data categories, estimated number of individuals, containment status, third parties involved, and a running decision log — lets the organisation file an initial notification that is accurate as far as it goes and clearly bounded in what it does not yet know. The same pack feeds the insurer notification, the customer letters and the board paper. One set of facts, consistently described, is the single most effective defence against allegations of inconsistency.

Regulators beyond Wilmslow

Sector obligations frequently bite earlier than the seventy-two-hour rule. Financial services firms must consider notification to the Financial Conduct Authority and the Prudential Regulation Authority under operational resilience and supervisory rules, alongside market disclosure duties. Regulated professionals — solicitors, accountants, healthcare providers, education settings and utilities — each have their own reporting route and their own timetable. Where the incident touches telecoms or essential services, additional regimes apply.

Commercial contracts are the most commonly overlooked clock. Supplier and customer agreements increasingly impose notification windows of twenty-four or forty-eight hours, and some require notification of suspected as well as confirmed incidents. Boards should know, before an event, which of their contracts impose the shortest deadline.

The market, the insurer and the statement

For companies admitted to trading, an incident may constitute inside information. The default position is prompt disclosure, with a narrow route to delay where a legitimate interest exists and confidentiality can be maintained; that decision must be recorded and the regulator informed. Divergence between what is filed with the ICO, what is announced to the market and what is written to customers is a gift to claimants and commentators alike.

Insurance notification should be treated as part of the same sequence. Policies commonly require prompt notice and can prejudice cover where it is late or incomplete.

Privilege is not a substitute for candour

Legal advice privilege protects communications seeking or giving legal advice; litigation privilege can extend to fact-finding conducted for the dominant purpose of litigation. Both have genuine value in structuring an investigation. Neither converts a regulatory notification into an optional exercise, and neither should be used to obscure facts the regulator will ultimately obtain. A clean factual record, kept separately from privileged advice, is the more durable approach — and cooperation is a mitigating factor in every enforcement framework that matters here.

One voice, and a short list of things not to say

Message discipline is a control, not a courtesy. A single spokesperson, a rehearsed holding statement, and a clear prohibition on speculative attribution or unqualified assurances about data exfiltration will prevent most self-inflicted harm. Where the risk to individuals is high, notification to those individuals may be required in addition to the ICO filing, and the wording should be consistent with everything else published.

Rehearse the whole chain

An annual table-top exercise that tests only technical response is a partial test. The exercise should include a live walkthrough of the ICO's reporting form, the out-of-hours contact list, the legal sign-off, the market disclosure decision and the insurer call. A short review within thirty days of any real event should ask a single question: which decision took longest, and why?

The disclosure clock is not a technical matter. It is a board matter, decided long before the incident by the quality of the protocol the board was willing to agree.