Security Breaches

What is a personal data breach

A personal data breach is any incident that leads to the accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to, personal data. Examples include a misdirected email, a lost phone or laptop, a hacked account, or documents left in view.

What we do when a breach occurs

Reporting to the ICO within 72 hours

If a breach is likely to affect the rights and freedoms of individuals, we report it to the UK supervisory authority, the Information Commissioner's Office (ICO), without undue delay and within 72 hours of becoming aware. If we report after 72 hours, we explain the reasons.

Notifying affected individuals

If a breach is likely to result in a high risk to you, we will notify you directly and without undue delay, in plain language: what happened, what data is involved, what we are doing and what you can do to protect yourself. For survivors, we do this in the safest way possible so as not to put anyone at greater risk.

How to report a breach to us

If you are in Romania or the EU

You can also report a data concern to the Romanian data protection authority, ANSPDCP (dataprotection.ro). See our Romania & EU page for details.