As of 13 August 2026, AI cannot decide whether to report a data breach to the ICO.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the ICO personal-data-breach guidance and your organisation's incident-response policy, and start an incident record.
   2. Gather the discovery time, suspected occurrence time, systems involved, data categories, affected people, access or disclosure evidence, containment actions and likely consequences.
   3. Remove unnecessary names and identifiers, then paste the factual incident record into the prompt and label every unknown item as unknown.
   4. Ask the chatbot to separate confirmed facts, assumptions, missing evidence and the relevant ICO reporting tests, with a source for each legal proposition.
   5. Compare every cited proposition and deadline against the current ICO guidance, and correct the incident facts against system logs, access records and the incident team’s evidence.
   6. Send the structured assessment and unresolved questions to your data-protection officer, solicitor or other qualified UK data-protection professional for the reporting decision.
   7. Record the decision, reasons, evidence, approval and timing in the incident register, then make any required ICO notification through the official ICO process.

   Prompt

   Act as a UK data-protection triage assistant, not the final decision-maker. Using the current official ICO guidance and UK GDPR principles available to you, analyse this suspected personal-data breach and produce: 1. a factual incident summary; 2. the facts that are still missing; 3. the relevant reporting tests and how each known fact bears on them; 4. arguments for and against notifying the ICO; 5. the questions a data-protection professional must answer; 6. the information needed for an ICO notification if notification is required; and 7. a clear provisional recommendation labelled 'not a legal conclusion'. Do not invent facts, thresholds, dates or affected-person numbers. Distinguish confirmed facts from assumptions, cite or name the official ICO source for each legal proposition, flag any uncertainty, and say when urgent escalation is needed. Do not decide that notification is unnecessary solely because the breach has been contained.
   
   Incident details:
   Organisation: [organisation name and sector]
   Date and time discovered: [date and time]
   Date and time the breach occurred or may have occurred: [date and time or unknown]
   What happened: [description]
   Personal data involved: [data types]
   Number and types of people affected: [details or unknown]
   Whether special-category or criminal-offence data was involved: [details or unknown]
   How the data was accessed, lost, altered or disclosed: [details]
   Likely consequences: [details]
   Containment and recovery steps: [details]
   Evidence available: [logs, messages, reports or other evidence]
   Current reporting deadline position: [what is known]
   
   Do not include unnecessary personal data. End by listing the exact points that must be checked against the ICO before any decision is recorded or notification is sent.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.