Is a data breach a crime?

Not usually for the business that suffers it, but deliberately misusing data can be an offence.

Can a data breach be verbal?

Yes. Telling the wrong person someone's personal details can count.

Is a data breach reportable, and what should I do?

Last checked: 17 October 2026 · The AI Till, UK

Short answer

A personal data breach must be reported to the ICO within 72 hours of finding it, if it's likely to risk people's rights and freedoms. If the risk is high, you must also tell the people affected without undue delay. A breach includes sending data to the wrong person or tool, not just hacking. Record every breach.

First 72 hours

Contain it: recall the email, revoke access, change passwords, delete shared links.
Work out what data, how many people and how sensitive.
Assess the risk to those people.
Report to the ICO if a risk is likely; use its self-assessment tool if unsure.
Tell affected people if the risk is high, with advice on protecting themselves.
Write down what happened and what you changed.

AI-related breaches

Pasting customer data into an AI tool isn't automatically a breach, but it can be if the tool isn't one you've approved, it isn't secure, or the data is used in ways customers weren't told about. A public chat link exposing customer details would be a breach. See can I put customer data into ChatGPT?

Fines

The ICO's maximum UK GDPR fine is £17.5 million or 4% of worldwide turnover, whichever is higher. Most ICO action against small firms is reprimands and orders, but failing to report can make things worse.

Who else to tell

Your insurer, the police or Report Fraud if it's a crime (Police Scotland in Scotland), and the NCSC for cyber attacks.

Sources

Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.

More on data, privacy and gdpr

All data, privacy and gdpr answers · All answers · Guides · AI tools directory

Get one useful AI tool in your inbox each weekday

Free, plain English, five minutes to read. Unsubscribe any time.

See our privacy notice.