UK GDPR 72 Hour Breach Deadline Calculator
Enter when you became aware of a personal data breach to see the 72 hour deadline in UK time, how long is left and what to decide along the way.
Worked examples
A breach found just before the clocks change
Aware at 12:00 UK time on Friday 23 October 2026
Deadline: Monday 26 October 2026 at 11:00 GMT
The clocks go back on Sunday 25 October, so 72 real hours end an hour earlier on the clock than 12:00.
About UK GDPR 72 Hour Breach Deadline Calculator
If your organisation has a personal data breach that is likely to put people at risk, UK GDPR Article 33 says you must tell the Information Commissioner's Office without undue delay and no later than 72 hours after you became aware of it. The hours are real hours. Weekends, bank holidays and the night count, and the clock keeps running while you investigate. In the middle of an incident, working out the exact deadline is the last thing you want to do by hand.
This calculator adds 72 hours to the time you became aware and shows the deadline in UK time, allowing for the clocks changing in March and October. It counts down how long is left, shows how many hours have gone, and lays out a plan with suggested checkpoints at 24, 48 and 72 hours. Three questions shape the guidance: whether personal data was involved, and whether harm to the people affected is unlikely, likely, or high, since a high risk means you must also tell them without undue delay. It is a planning aid and not legal advice.
How to use UK GDPR 72 Hour Breach Deadline Calculator
- Enter the date and time you became aware of the breach and choose the time zone it is in.
- Say whether personal data was involved and how likely harm to the people affected is.
- Read the deadline, the time left and the plan with checkpoints.
- Record who knew what and when, and report to the ICO before the deadline.
Common uses
- Setting the deadline when an incident is first reported to you
- Briefing a manager or director on how long is left
- Planning the response with checkpoints at 24, 48 and 72 hours
- Training staff on what the 72 hour rule means in practice
Frequently asked questions
When does the clock start?
From the moment you become aware of the breach. Guidance treats you as aware when you have a reasonable degree of certainty that a security incident has led to personal data being compromised. It is not the moment of the breach itself, and not the moment the first suspicion arises.
Do weekends and bank holidays count?
Yes. The 72 hours are continuous elapsed hours, so a breach discovered on Friday afternoon is due on Monday afternoon. This calculator uses real hours, so it also handles a clock change inside the period.
What if I don't have all the details by the deadline?
Report anyway with what you know. The law allows information to be given in stages without further undue delay. If you report after 72 hours, you must say why.
Do I always have to report?
No. You do not need to tell the ICO if the breach is unlikely to result in a risk to people's rights and freedoms. You must still record every breach and the reasons for your decision.
What if a supplier has the breach?
A processor that handles data for you must tell you without undue delay after it becomes aware. Your own deadline is counted from when you are told, but you should not delay asking.