United Kingdom

Under UK GDPR, implemented by the Data Protection Act 2018, a controller must notify the Information Commissioner's Office of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals (Article 33). When a breach is likely to result in a high risk to those individuals, the controller must also notify them directly, without undue delay (Article 34).