You should ensure that you record all breaches, regardless of whether or not they need to be reported to the ICO. Article 33(5) requires you to document the facts regarding the breach, its effects and the remedial action taken.

When should a data security incident be reported?

If a personal data breach needs to be reported to the ICO, you have 72 hours after becoming aware of it to do so. If you take longer than this, you must give justifiable reasons for doing so. The 72 hours includes evenings, weekends and bank holidays.

When should a data security incident be reported NHS?

Article 33 of GDPR requires reporting of a breach within 72 hours. This is from when the CCG becomes aware of the breach and may not be necessarily when it occurred. However, it is important that all staff report any IG incidents / breaches AS SOON AS POSSIBLE.