Probably, yes, it is a personal data breach. A breach is any security incident where personal data is lost, stolen, destroyed, changed, sent to the wrong person or accessed without permission. You must report it to the ICO without undue delay and within 72 hours of finding out, unless it is unlikely to result in a risk to the people affected. If the risk to them is high, you must tell them too, without undue delay. Whether you report it or not, you must record it. The ICO has a simple 72-hour guide for small businesses and sole traders.
Last updated 2 November 2026. Checked against the ICO's own pages on ico.org.uk.
Not legal advice. This is a plain-English summary of the ICO's own published guidance, checked on 2 November 2026. For advice about your situation, speak to a solicitor or call the ICO's helpline on 0303 123 1113.
DataSorted is not affiliated with the ICO. DataSorted is a waitlist and demand test only: no product is live and no payment is taken.
A personal data breach happens when personal data is accidentally lost, destroyed, corrupted or disclosed, when someone accesses or passes it on without permission, or when it becomes unavailable in a way that significantly affects people. The ICO's own examples include an email sent to the wrong person, a laptop stolen from a car, files lost in a flood, and lost or stolen devices holding personal data.
A lost phone with customer contacts, messages or job details is a breach of personal data. How serious it is depends on what was on it and how well it was protected, for example a passcode and encryption, and whether you could wipe it remotely. In one ICO case study an unencrypted laptop was lost, the business couldn't tell whether the data had been accessed, and it reported the breach and told the people affected. If you can't be sure the risk is low, use the ICO's self-assessment or call the helpline.
This is a breach too, but it may be low risk. The ICO's example: a hair appointment reminder sent to the wrong customer, who then deleted it, is unlikely to need reporting to anyone. It should still go in your breach log.
Report online with the ICO's breach reporting form. The ICO says it takes about 30 minutes and you can't save it and come back, so have the details ready. You may also want to tell your insurer, the police (through Report Fraud) if a crime was involved, and the National Cyber Security Centre if someone attacked your systems.
The ICO says its breach guidance is under review after the Data (Use and Access) Act 2025. The 72-hour rule for UK GDPR breaches is unchanged on its pages as of 2 November 2026.
Yes, if it holds personal data such as customer contacts or messages. Whether you must report it to the ICO depends on the risk to those people, for example whether the phone was locked and encrypted and whether you could wipe it remotely.
Without undue delay and within 72 hours of finding out, unless the breach is unlikely to result in a risk to people. The clock starts when you discover the breach, not when it happened.
Only if the breach is likely to result in a high risk to them. Then you must tell them without undue delay and explain how they can protect themselves.
You must still record the breach in your log, and you should write down why you decided not to report it, so you can justify the decision.
No. It is a plain-English summary of the ICO's guidance, checked on 2 November 2026. DataSorted is a waitlist test only and is not affiliated with the ICO.
Everything above is taken from these ICO pages, checked on 2 November 2026. If anything here differs from the ICO, the ICO is right.
DataSorted is a planned phone-friendly helper for UK tradespeople and small businesses. It is not built yet. If you'd like to hear if it launches, join the free waitlist. It is free, nothing is charged, and you can ask to be removed at any time. Everything on this page can also be done for free using the ICO's own tools.