When must a personal data breach be reported to the ICO?

A controller must notify the Information Commissioner without undue delay and, where feasible, within seventy-two hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. Where the risk to individuals is high they must also be told without undue delay. Every breach must be recorded internally, whether or not it is reported.