How does the decision tree help with UK GDPR breach reporting?

The decision tree helps assess whether an incident involves personal data, whether there is a risk to individuals, whether notification to the ICO is required, and whether individuals, customers, regulators, insurers, or contractual partners should be informed.

Do all UK incidents need to be reported only to the ICO?

Potentially. Depending on the organisation and incident, reports may be required to sector regulators, the National Cyber Security Centre, law enforcement, financial regulators, healthcare regulators, contractual customers, insurers, or supply chain partners.

What should be documented when using the incident notification decision tree?

UK GDPR requires controllers to document personal data breaches, including facts, effects, remedial action, risk assessment, notification decisions, timing, and reasons for reporting or not reporting. Good records also support governance and audit readiness.

What is the difference between a decision tree and an incident response plan?

A decision tree is a quick assessment tool for notification decisions. An incident response plan is a broader document setting out roles, responsibilities, escalation routes, investigation steps, communications, recovery procedures, evidence handling, and post-incident review.

Is the incident notification decision tree legal advice?

No. It provides general guidance for UK incident notification decisions. Organisations should seek legal, regulatory, or specialist advice for serious incidents, uncertain reporting duties, cross-border breaches, criminal activity, or sector-specific obligations.

If an incident is not notifiable, can it be ignored?

Not necessarily. Even where external notification is not required, the incident should usually be logged, investigated, contained, reviewed, and escalated internally if it exposes security weaknesses, contractual issues, or operational risk.

How often should a UK incident notification decision tree be reviewed?

It should be reviewed regularly and updated when UK data protection law, ICO guidance, sector rules, contractual obligations, insurance requirements, cyber threat conditions, or the organisation’s incident response plan changes.

EN-GB>Governance>Incident Response Plan>United Kingdom Incident Notification Decision Tree

United Kingdom Incident Notification Decision Tree

Created: 11 Jun 2026

This flowchart helps United Kingdom organisations decide when and how to report an incident, supporting faster, more consistent response decisions. It complements the AI Generated Incident Response Plan for use in the United Kingdom.

Incident Notification Decision Tool

15%

Does the incident involve personal data?

Yes

Start by identifying what has happened, what systems or people are affected, and whether the incident involves personal data, safety, regulated services, crime, or critical operations. A single incident may trigger more than one notification duty, so follow every relevant branch rather than choosing only one route.

Further Reading: NCSC: Report A Cyber Incident, ICO: Personal Data Breaches

Disclaimer:

I understand and accept that the flowchart, questionnaire, decision tree, and any results, guidance, classifications, or recommendations provided by Docaro are generated automatically for general informational purposes only and do not constitute legal advice, legal representation, or any other professional advice. No solicitor-client, attorney-client, or other professional advisory relationship is created through use of this service. I acknowledge that the tool operates using simplified rules and assumptions and may not take into account all facts, circumstances, exceptions, legal requirements, or jurisdiction-specific considerations relevant to my situation. The results may be incomplete, inaccurate, outdated, or unsuitable for my particular circumstances. I agree that any outcome or recommendation provided by the tool is indicative only and should not be relied upon as a substitute for independent legal advice. I am solely responsible for verifying the accuracy and suitability of any information provided and for obtaining advice from a qualified legal professional where appropriate. To the fullest extent permitted by applicable law, Docaro disclaims all warranties and liability arising from the use of, or reliance upon, any information, outcome, recommendation, or guidance provided by this service.

Why Is The Right UK Incident Notification Decision Important?

Incident notification in the United Kingdom can involve several overlapping duties. A single event may require notice to the ICO, HSE, NCSC, police, a sector regulator, insurers, customers, or affected individuals. Making the right decision helps an organisation respond lawfully, quickly, and consistently.

How Can Incorrect Notification Decisions Create Legal Risk?

Failing to notify the right body, or notifying too late, can lead to regulatory investigation, enforcement action, loss of trust, and avoidable harm. For example, UK GDPR personal data breaches that are likely to risk individuals must normally be reported to the ICO within 72 hours of awareness. Work-related serious injuries and dangerous occurrences may need RIDDOR reporting to HSE or the relevant enforcing authority.

Why Do UK Incident Response Plans Need Clear Escalation Routes?

A documented incident response plan helps staff identify when an incident is not just an IT issue, but also a legal, safety, regulatory, contractual, or communications issue. Clear escalation routes reduce delay and make it easier to preserve evidence, protect people, contain harm, and coordinate notices.

What Should UK Organisations Record After An Incident?

Organisations should keep a proportionate record of the incident, the facts known at the time, the risk assessment, who made the notification decision, what notices were sent, and what remediation followed. Good records support accountability and help explain why a notice was or was not required.

Personal data: assess ICO and individual notification duties.
Health and safety: check RIDDOR reporting obligations.
Cyber incidents: consider NCSC, Action Fraud, or police reports.
Regulated sectors: check FCA, PRA, Ofcom, CQC, Charity Commission, or other rules.
Contracts and insurance: check short notice periods and approval requirements.

For official guidance, see the ICO guidance on personal data breaches, HSE guidance on RIDDOR, and NCSC guidance on incident management.

United Kingdom Incident Notification Decision Tree

This flowchart provides a simplified overview of legal concepts and should not be relied upon as legal advice. Always consider the specific facts of your situation and seek professional advice where appropriate.

Want to Generate Your own Incident Response Plan?

Docaro AI can help you write your own Incident Response Plan for use in the United Kingdom in minutes.

Generate Your Document Now

FAQs

What is a United Kingdom Incident Notification Decision Tree?

A United Kingdom Incident Notification Decision Tree is a structured flowchart that helps organisations decide whether a security, privacy, operational, or regulatory incident must be reported, to whom, and within what timeframe. It supports—but does not replace—a full incident response plan.

Who should use an incident notification decision tree?

What types of incidents does the decision tree cover?

When must a personal data breach be reported to the ICO?

When must affected individuals be notified of a data breach?

Show All FAQs

You Might Also Be Interested In

Incident Response Plan Section Catalogue In The United Kingdom

Browse the United Kingdom incident response plan section catalogue to find key templates, topics, and guidance for faster planning.

Incident Response Roles And Responsibilities Matrix In The United Kingdom

Clarify United Kingdom incident response roles, responsibilities and escalation paths with a practical matrix for faster breach handling.

Incident Escalation Criteria Dataset In The United Kingdom

Incident escalation criteria dataset for the United Kingdom, helping teams define clear triggers for faster, consistent response.

United Kingdom Incident Response Plan Selection Flowchart

United Kingdom flowchart to help select the right incident response plan quickly, clearly, and confidently.