Data Breach and Cyber Incident Response for Care Providers

A lost laptop, an email sent to the wrong address, or a ransomware attack on a care management system are all personal data breaches — and under UK GDPR, a care provider can face a strict 72-hour clock the moment one is discovered. Knowing what actually triggers that clock, and what to do once it starts, is essential knowledge that goes well beyond the IT team alone.

When the 72-Hour Duty Applies

The Information Commissioner's Office (ICO) is clear that organisations must report a qualifying personal data breach "without undue delay and within 72 hours." The clock starts from when the breach was discovered, not from when it actually happened — a breach that occurred weeks earlier but was only identified today starts a fresh 72-hour countdown from today. Not every incident meets the threshold for reporting to the ICO, however: the guidance is explicit that organisations should assess the risk of harm to the people affected, and if there is not a high risk to those individuals, formal notification to affected people may not be required, and some lower-risk breaches may not need reporting to the ICO at all. This judgement call needs to be made quickly and by someone who understands both the data involved and the risk of harm, not left unclear until the deadline has already passed.

What a Breach Report Must Include

When a report to the ICO is required, it should set out what happened and when, a risk assessment of the potential harm to those affected, and what has already been done to contain the breach. Crucially, an organisation does not need complete information within the 72-hour window — the ICO's own guidance encourages providing as much detail as possible within that period, with further information supplied afterwards as part of a follow-up report once the full picture becomes clear.

Why This Matters More in Care Than Most Sectors

Care providers hold some of the most sensitive personal data that exists — health records, safeguarding histories, medication details, and next-of-kin information for people who are often unable to protect their own interests. This is why GDPR and data protection training needs to sit alongside genuine incident response readiness, not stop at policy awareness. Staff at every level, not just those managing IT systems, need to know what a potential breach looks like in practice — a resident's care notes accidentally emailed to the wrong recipient, a phone with resident information lost or stolen, or a suspicious email that has already been clicked — and exactly who to tell immediately.

Building an Internal Escalation Route

Every service needs a clear, well-known internal route for reporting a suspected breach the moment it is noticed, rather than staff being unsure whether something "counts" and delaying while they decide. A named data protection lead — sometimes the same person who leads on the wider cyber security awareness already covered in existing training — should be the first point of contact, empowered to make the initial risk assessment quickly and start the 72-hour clock running correctly from the moment of discovery, not from whenever the report happens to reach them.

Everyday Prevention: What Every Care Worker Can Do

Most breaches in care settings start with an ordinary mistake rather than a sophisticated attack, so prevention rests largely on everyday staff habits rather than technical controls alone. Phishing emails remain the most common entry point: a message that looks like it is from a pharmacy supplier, a GP surgery, or even a colleague, asking staff to click a link, open an attachment, or "verify" login details. Staff should be encouraged to check the sender's actual email address rather than just the display name, hover over links before clicking, and report anything suspicious to a manager immediately rather than deleting it and saying nothing — a reported near-miss is far more useful than a silent one.

Device security matters just as much as email vigilance. Work devices and any personal devices used to access resident records should be locked with a PIN or password whenever left unattended, even for a few minutes on the ward or in the office. Shared devices used across shifts, such as medication trolleys with built-in tablets or a communal office computer, should always be logged out of individual accounts at the end of a session rather than left signed in for the next person. Passwords should never be shared between colleagues or written on sticky notes near a screen, and where the provider's systems support it, staff should use a different password for each system rather than reusing one password across email, care planning software, and rostering tools.

Finally, staff should know that USB sticks, personal cloud storage, and personal email accounts are not appropriate places to store or transfer resident information, however convenient they may seem when working across sites or from home. If a task genuinely requires moving data between systems, staff should ask their manager or IT lead for the approved method rather than improvising one. These habits cost nothing to implement and, together, close off the majority of the routes through which care sector data breaches actually happen.

Frequently Asked Questions

Does every data breach have to be reported to the ICO?
No. Only breaches that meet the risk threshold need to be reported, based on the level of risk to the people affected. However, that risk assessment needs to happen promptly and by someone competent to make the judgement, not skipped entirely.

What starts the 72-hour countdown?
The clock starts from when the organisation becomes aware of the breach, not from when the breach actually occurred, which can sometimes be considerably earlier.

Can a report be submitted with incomplete information?
Yes. The ICO's own guidance accepts that full details may not be available within 72 hours, and allows a follow-up report to provide further information once it becomes available.

A calm, well-understood breach response process protects residents' most sensitive information at exactly the moment it is most vulnerable — and getting the first hour right, by escalating quickly rather than hesitating, often matters more than any single technical safeguard.