FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Insurance explained
The first 72 hours after a cyber breach are when a UK business contains the attack, preserves evidence, calls its insurer and decides whether to report lost personal data. Decisions made in that window shape the legal position, the insurance claim and the cost of recovery.
Part of: Commercial insurance
In short
After a suspected breach, isolate affected systems without wiping them, call your cyber insurer's incident line before appointing your own vendors, and keep logs and a timeline. If personal data is involved, UK GDPR Article 33 requires a report to the regulator within 72 hours of becoming aware, unless the risk to individuals is unlikely, and Article 34 requires telling people if the risk is high. Report the crime to Report Fraud, which replaced Action Fraud in December 2025. Never pay a ransom without sanctions checks and insurer consent, call your bank at once if money moved, and notify PI or D&O insurers of circumstances.
The 72 hours after a suspected breach are about four things at once: stopping the damage spreading, keeping the evidence, getting the right help on the phone and meeting legal deadlines. The 72 hour figure itself comes from Article 33 of the UK GDPR, which deals with reporting personal data breaches to the regulator. It is not a deadline to fix the problem, and many incidents take weeks to resolve fully.
A practical order for most UK businesses looks like this:
Our guide to cyber breach response coordination explains how these workstreams fit together, and how cyber insurance incident response works covers the insurer's side in more detail.
Cyber policies commonly require you to report an incident promptly and to use the insurer's panel of responders, or to get the insurer's written consent before incurring costs. If you hire your own forensic firm or lawyers first, the policy may not pay their fees, or may pay only what the panel would have charged. The exact rule is in the policy conditions, so it is worth reading them before anything happens.
The hotline usually connects you to a breach coach, often a law firm, who then brings in forensic IT, notification support and, where needed, PR. Many policies treat the early response costs separately from the main excess, but that is subject to the wording. Keep a note of the time you called and the reference you were given.
Evidence matters for three reasons: the forensic team needs it to find the entry point, the insurer needs it to assess the claim, and the police may need it. Turning machines off, restoring from backup over infected systems or deleting suspicious emails can destroy the trail. If in doubt, isolate rather than erase.
Under Article 33, a controller must report a personal data breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. The regulator says the clock starts when you discover the breach, not when it happened. If you report late, you must give reasons for the delay. If you do not have all the facts, the information can be provided in phases.
Since 30 September 2026 the Information Commission has taken over from the ICO as the UK data protection regulator; the government says its role, responsibilities and powers are unchanged. Its personal data breach guidance and self-assessment tool remain the starting point.
Under Article 34, if the breach is likely to result in a high risk to individuals, you must also tell them without undue delay. That duty does not apply where the data was protected so that it is unintelligible, such as by encryption, where later steps mean the high risk is no longer likely, or where individual notice would involve disproportionate effort, in which case a public communication is used instead. Every breach must be documented, whether reported or not, under Article 33(5).
Processors, such as an IT provider or payroll bureau, must tell the controller without undue delay. Our ICO data breach statistics page shows the kinds of incidents reported most often.
Action Fraud was replaced on 4 December 2025 by Report Fraud, run by City of London Police at reportfraud.police.uk, as the national service for reporting fraud and cyber crime. The NCSC small business guide tells businesses to report attacks to the police through Report Fraud, or to Police Scotland on 101. For organisations, the NCSC's where to report a cyber incident service on GOV.UK signposts the right route.
If a ransom is demanded, OFSI's financial sanctions guidance for ransomware says a ransomware payment can breach the ban on making funds available to a designated person subject to an asset freeze, and that breaches of financial sanctions are a serious criminal offence. The government does not encourage or condone ransom payments, and OFSI does not prescribe specific due diligence, so the onus is on the organisation. OFSI treats reporting the incident through the where to report a cyber incident service, engaging with law enforcement, and prompt, complete voluntary disclosure of any payment to OFSI as mitigating factors. Whether a policy responds to extortion at all, and on what conditions, depends on the wording; see ransomware cover across cyber, property and BI.
If an invoice or payment has been diverted, call your bank and the receiving bank straight away; speed gives the best chance of freezing funds. Our page on social engineering and fund transfer fraud explains how that loss is usually insured.
| Step | Cover that may respond | Watch for |
|---|---|---|
| Incident response and forensics | Cyber (first party) | Panel and consent conditions |
| Legal advice and regulator reporting | Cyber (first party) | Fines may not be insurable or covered |
| Notifying individuals, credit monitoring | Cyber (first party) | Sub-limits |
| Lost income while systems are down | Cyber business interruption | Waiting period before cover starts |
| Ransom demand | Cyber extortion, if included | Insurer consent, sanctions checks |
| Diverted payments | Cyber or crime social engineering extension | Low sub-limits, verification conditions |
| Claims from clients or data subjects | Cyber liability, sometimes PI | Cyber exclusions in PI |
A breach can also be a circumstance that might lead to a claim against a professional firm or its directors. PI and D&O policies are usually claims made, so late notification can cause problems; see cyber and PI notification obligations and GDPR fines versus civil claims.
The following examples are illustrative only and are not real cases.
For the wider picture of cover after an incident, read business insurance after a cyber attack.
The most common mistake is treating the 72 hours as time to investigate before saying anything. The regulator expects a report within 72 hours where a reportable breach is likely, even with incomplete facts, and the insurer usually expects to hear much sooner. Waiting to be sure can breach both.
Before buying or renewing cyber cover, check:
Our commercial cyber insurance broker guide covers placement in more depth. Apex arranges cyber insurance for UK businesses; a broker reads every enquiry.
See also: The ICO is now the Information Commission: what professional firms need to know
No. Under Article 33 of the UK GDPR you must report a personal data breach without undue delay and, where feasible, within 72 hours unless it is unlikely to result in a risk to individuals. You must still record every breach. The Information Commission, which took over from the ICO on 30 September 2026, has a self-assessment tool to help.
Report Fraud replaced Action Fraud on 4 December 2025 and is run by City of London Police at reportfraud.police.uk. In Scotland, report to Police Scotland on 101. The NCSC's where to report a cyber incident service on GOV.UK helps organisations find the right route.
If you have cyber insurance, call the insurer's incident line first, or at the same time as basic containment. Many policies require you to use panel responders or get consent before incurring costs, and fees for vendors you appoint yourself may not be paid. Check the conditions in your own policy.
OFSI guidance says paying a ransom to a person or entity under financial sanctions is a serious criminal offence. The government does not encourage or condone any ransom payment. Insurers commonly require consent and sanctions checks before any payment is considered, subject to the policy terms.
Under Article 34, you must tell affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms. You may not need to if the data was encrypted, if later steps removed the high risk, or if a public notice is used because individual contact would be disproportionate.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
