Told Your Data Was Breached? 8 Steps to Take in the UK

You can’t undo a breach at someone else’s company, but you can make the stolen data far less useful. Work through these steps in order, starting with the ones that match the type of data the notice says was exposed.

1. Make sure the notice is genuine

Criminals know breach notices make people act quickly, so fake ones are common. Don’t click links or call numbers in the email, text or letter. Go to the organisation’s website by typing its address, or use a phone number you already have, and check what it has published.

A genuine notice should tell you what happened. Under UK data protection law, when a breach is likely to put people at high risk, the organisation must tell them without undue delay and explain:

• who to contact for more information;
• the likely consequences of the breach;
• what it has done, or will do, about it;
• what you can do to protect yourself.

Note exactly what was exposed (passwords, card numbers, your address, date of birth, ID documents) and check back for updates, because the full picture often emerges later.

2. Change the password, and any that match it

If a password was involved and you still use it, the NCSC says to change it as soon as you can, along with any other account that uses the same password. Make each new one different. Our guide to creating strong passwords shows how to do that without a perfect memory.

You can check whether your email address appears in other public breaches at Have I Been Pwned, a site the NCSC points to.

3. Turn on two-step verification, or use a passkey

Two-step verification (2SV) means a stolen password isn’t enough to get into your account. Switch it on for the breached service and for your email, banking and shopping accounts. Where a service offers a passkey, the NCSC now recommends using it, because passkeys can’t be phished.

4. Tell your bank if card or bank details were involved

Call the number on the back of your card. Your bank may cancel the card and send a new one. Watch your statements for several weeks for payments you don’t recognise, however small.

5. Check your credit file

The UK doesn’t have a US-style “credit freeze”. Instead:

• Check your credit file. You have the right to a free copy of your file from each of the three main credit reference agencies, Experian, Equifax and TransUnion, as the ICO explains. Look for searches or accounts you don’t recognise.
• Consider Protective Registration. If identity details such as your passport, driving licence or date of birth were exposed, Cifas Protective Registration puts a warning against your name so that organisations do extra checks when your details are used. At the time of writing (October 2026) it costs £30 for two years.

6. Expect follow-up scams

Stolen contact details are often used for phishing, and the NCSC warns that suspicious messages may arrive some time after a breach is made public. They may mention the breach itself, or offer a refund or help.

• Forward suspicious emails to report@phishing.gov.uk.
• Forward scam texts to 7726.
• Never give passwords or one-time codes to anyone who contacts you, even if they say they’re from your bank.

If you lose money, tell your bank and report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.

7. Tell your IT support if work is involved

If you used your work email to sign up to the breached service, or used the same password at work, tell your IT support. They can reset your work password, check for unusual sign-ins and look out for phishing aimed at you or your colleagues. This is part of what our cyber security service does for clients, alongside 24/7 monitoring of Microsoft 365 accounts.

8. Know your rights

Under UK data protection law you can complain about how an organisation handled your personal data:

• Complain to the organisation first. Since 19 June 2026, the Data (Use and Access) Act 2025 has required organisations to make it easy to complain, acknowledge your complaint within 30 days and respond without undue delay.
• Then go to the ICO if you’re unhappy with the response. The ICO asks people to give the organisation a chance to put things right first.
• Compensation. Article 82 of the UK GDPR gives you the right to compensation for damage, including distress, caused by a breach of data protection law. The ICO can’t award compensation itself; the organisation may agree to pay, and if not, a court can decide.

If your business is the one that was breached

The steps above are for individuals. If your business has lost personal data, the rules are different: you may need to report it to the ICO within 72 hours of becoming aware of it, and tell the people affected. Our guide to preventing a data breach covers how to make that less likely.