Rehearse the Awkward Call: Your 30-Minute ICO Breach Drill

There is a particular kind of silence that falls over a small office when someone says the words "possible data breach". It is not panic exactly. It is more the sound of everyone waiting for someone else to know what happens next. In a business of eight, fifteen or forty people, that someone is usually whoever happens to be nearest the router.

The Information Commissioner's Office gives you 72 hours from the moment you become aware of a reportable breach. Not 72 hours from when you finish investigating. Not 72 hours from when you have a tidy explanation. Seventy-two hours from awareness. That clock is unforgiving, and it is the reason this drill exists.

The good news: you do not need a legal department to run it. You need half an hour, a meeting room, a flipchart, and the willingness to say awkward things out loud. Think of it as a fire drill for paperwork.

Why bother rehearsing a phone call?

Because the first time you ring the ICO should not also be the first time you have thought about what to say. Under pressure, teams do strange things. They wait for certainty. They draft a perfect statement nobody reads. They forget the name of the person who owns the customer database. They discover, at 4:55pm on a Friday, that the only person who knows the insurer's policy number is on a flight to Malaga.

A tabletop rehearsal puts those gaps on the table while the stakes are low. It also gives you something genuinely useful: a one-page record showing you acted promptly. Regulators and insurers alike tend to look kindly on a business that can demonstrate it had a plan and followed it, even when the plan was imperfect.

What actually counts as reportable?

Here is the plain-English version. A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That covers a lot more than a hacker. It includes the payroll spreadsheet emailed to the wrong "Sarah", the laptop left on the train, the CRM export saved to a personal Dropbox, and the invoice scam that convinced a client to pay the wrong account.

You must report it to the ICO within 72 hours if it is likely to result in a risk to people's rights and freedoms. That phrase does real work. A lost encrypted laptop with a strong passphrase and remote wipe is usually not reportable. A lost unencrypted laptop with staff NI numbers on it usually is. A mailing list sent with everyone's email addresses in the "To" field is embarrassing and often reportable. A single misdirected internal email to a colleague who should have seen it anyway is usually not.

The test is risk, not drama. If you are unsure, ring the ICO's helpline and talk it through. That call itself is worth rehearsing.

The four things the ICO will ask

You are not expected to have every answer. You are expected to have the shape of the answers. When you ring the ICO breach line, the conversation tends to circle around:

• What happened. The nature of the breach, roughly when it happened, and how you found out.
• Who and how many. The categories of people affected and an approximate number of individuals and records. "About 40 current staff and possibly 12 former staff" is more useful than "a lot".
• What you have done so far. Containment, password resets, device wipes, isolating accounts, telling your IT provider.
• What happens next. Who is leading the response, how you will contact affected people, and when you will update the ICO.

That is it. They are not marking your grammar. They are trying to understand scale and seriousness.

The one-page incident log

This is the artefact that proves you acted promptly. Keep a single template somewhere everyone can find it, and fill it in as you go. Date and time of awareness. Who noticed. What was affected. What you did in the first hour. Who you told internally. Who you told externally, including the ICO reference number if you get one. What you still do not know.

A shared document is fine. A printed sheet in a folder is also fine. What is not fine is a verbal briefing that evaporates by Tuesday.

Running the half-hour drill

Set a calendar invite. Call it something unthreatening like "Incident walkthrough". Nobody needs to dress up as a hacker.

Minutes 0–5: Pick a scenario. Use a realistic one. A staff laptop is stolen from a car outside a client site. Or a phishing email has convinced accounts payable to change a supplier's bank details. Or a shared mailbox has been accessed from an unfamiliar country. Keep it specific enough to argue about.

Minutes 5–10: Name the owner. Who is incident lead? Who is their deputy? Who rings the ICO if the lead is on annual leave? Write the names on the flipchart. This is the step most small businesses skip and most regret.

Minutes 10–20: Walk the first 72 hours. What happens in hour one? Who isolates the device? Who checks the backup? Who drafts the internal message? Who calls the insurer, the bank, the client, the IT support desk? Who decides whether to notify affected individuals? You will find at least one missing phone number. Write it down.

Minutes 20–25: Draft the ICO call. Have someone actually say out loud: "Hello, I am ringing to report a personal data breach." Then answer the four questions above in plain sentences. It will feel silly. It will also be the most useful five minutes of the drill.

Minutes 25–30: Fix two things. Not twenty. Two. Add the missing number to the contact sheet. Name a deputy. Put the incident log template in the shared drive. Diarise the next drill for twelve months' time.

The tripwires to watch for

Waiting for perfect facts is the big one. You can report a breach and update the ICO later; you cannot un-miss the deadline. The second is treating it as an IT problem alone. A breach is a business problem that IT helps solve, and the person who rings the ICO should be a named human, not a shared inbox. The third is forgetting the people on the other side. If the risk is high, you may need to tell affected individuals without undue delay, and that message needs drafting before you are emotional and exhausted.

After the drill

File the notes. Note the date. Then go back to running the business. The point of the rehearsal is not to become a compliance enthusiast. It is to make the worst phone call of the year feel like something you have already done once, in a meeting room, with biscuits.