United KingdomUK GDPR Articles 33-34 and PECR, Breach Notification in the United Kingdom
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Information Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in the United Kingdom, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, and if you are a telecoms or ISP-type provider, notify a PECR breach to the Information Commission within 72 hours.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Arts. 33-34 fall within "the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43" in Art. 83(4)(a), which sets the standard maximum amount: the higher of £8,700,000 or 2% of worldwide annual turnover (DPA 2018 s.157(6)). The Data (Use and Access) Act 2025 Sch. 13 (amending DPA 2018 s.157(2) as applied to the PEC Regulations) replaced PECR's former flat £500,000 maximum with this same higher/standard maximum framework, but only for the PECR provisions Sch. 13 para. 18 enumerates (regs. 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 and 24, chiefly the marketing and cookie-consent rules; verified at https://www.legislation.gov.uk/ukpga/2025/18/schedule/13). PECR's own personal-data-breach notification duty (reg. 5A) is not in that enumerated list and keeps a separate, much smaller fixed monetary penalty of £1,000 per failure (£800 if paid within 21 days of the notice of intent) under reg. 5C, unaffected by the DUAA realignment (https://www.legislation.gov.uk/uksi/2003/2426/regulation/5C).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 8,700,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority
- Open questions
- From what point do the 72 hours under regulation 5A run for a provider of a public electronic communications service, if the Information Commission’s guidance counts them from "becoming aware of the essential facts of the breach"?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 33(5) requires the controller to document every personal data breach, whether or not it is notified, covering the facts, the effects and the remedial action, in a form that lets the Commission verify compliance. Regulation 5A(8) of PECR imposes the same inventory duty on a communications service provider. The documented items are outside the closed list of log contents. The notification duties in Articles 33(1) to (4) and 34 are reports, not records.
- Kind
- Explicit
- As of
- Provision
- UK GDPR Article 33(5); Privacy and Electronic Communications Regulations 2003, regulation 5A(8)
- Trigger
- security_incident
What this law does
UK GDPR Articles 33 and 34 retain the same 72-hour and without-undue-delay structure as EU GDPR, with no threshold for how serious a breach must be before it is notifiable. The DUA Act lengthened the separate PECR breach-notification window for telecoms and ISP-type breaches from 24 hours to 72 hours where feasible, in force , aligning it with the UK GDPR timeline.
From it also raised the maximum penalty for most PECR contraventions to GBP 17.5 million or 4 percent of worldwide turnover, up from GBP 500,000, but a failure to notify a PECR breach under regulation 5A is excluded from that penalty-notice power.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .