Report a personal data breach

If a personal data breach has occurred that should be notified to the Commissioner, the personal data breach form on this page should be completed and emailed to

The Commissioner should be notified within 72 hours of becoming aware of the breach.  If more than 72 hours has elapsed, the email accompanying the report form must provide an explanation for the delay.

If the complete information regarding the breach is not yet available, the email accompanying the report form should state this to be the case and include further information and an estimated timescale for the submission of the remaining information, which should be without further undue delay.  



Personal Data Breach Report Form