As of 13 August 2026, AI can only partly decide whether to report a data breach.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open GOV.UK and find the current ICO guidance on personal data breaches, alongside your organisation's incident-response and data-protection policies.
   2. Create a factual incident timeline containing discovery time, containment actions, systems affected, data categories, approximate number of people affected and likely consequences, removing unnecessary personal identifiers.
   3. Ask the incident lead, IT team and relevant data owner for the missing facts, and record unknown or disputed points instead of filling them in.
   4. Paste the redacted facts, the relevant policy and the copyable prompt into a chatbot, then require citations to the current ICO pages it used.
   5. Compare every cited reporting requirement and timing point against the live ICO guidance and your own policy, correcting any unsupported statement in the draft.
   6. Send the decision matrix and incident record to your DPO, privacy lead or data-protection solicitor for the accountable decision, and follow the approved reporting route if they decide notification is required.
   7. Store the final decision, evidence, guidance links, decision-maker and reasons in the incident record, including why reporting was or was not chosen.

   Prompt

   Help me assess whether this personal data breach may need reporting in the UK. This is decision support only, not professional advice, and you must not make the final decision for my organisation.
   
   Use the current ICO guidance on personal data breaches, found through GOV.UK or the ICO website, as the primary source and cite the exact page or section for every important conclusion. If the guidance has changed, say so and use the current version. Do not invent facts, deadlines, thresholds or legal duties. Do not treat an absence of information as proof that no risk exists.
   
   First, list the facts that are known, unknown and disputed. Then identify the missing facts that could change the decision. Assess separately:
   1. the likelihood and seriousness of risk to people;
   2. whether notification to the ICO appears required;
   3. whether communication to affected people appears necessary;
   4. any relevant timing or record-keeping requirements in the current ICO guidance.
   
   Give me a short decision matrix with the evidence for and against each route: notify the ICO, notify affected people, notify neither, or obtain urgent specialist advice. Mark each conclusion as fact, guidance-based inference, or unresolved judgement. State clearly where a data-protection professional or our DPO must decide.
   
   Create a neutral incident decision record with these headings: incident summary, discovery time, containment, data involved, people affected, likely consequences, safeguards, risk assessment, guidance consulted, decision, decision-maker, reasons, actions, owner and review time.
   
   Incident facts:
   [Paste only the minimum necessary information, with names, addresses, account details and other unnecessary identifiers removed]
   
   Organisation policy or incident procedure:
   [Paste the relevant policy]
   
   Do not send, submit or contact anyone. Do not claim that a breach is reportable unless the evidence and current ICO guidance support that conclusion.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.