What should a Scottish charity do in the first 72 hours after a data breach or cyber attack?

Why the first 72 hours decide how bad it gets

The government's Cyber Security Breaches Survey 2025/2026 found that 28% of UK charities had a breach or attack in the previous 12 months. Only 19% had a formal incident response plan. So most charities work out what to do while the incident is happening, and that's when evidence gets wiped, deadlines get missed and beneficiaries hear about it from someone else.

The clock that matters most is the UK GDPR one. The ICO says the 72 hours run from when you discovered the breach, not from when it happened. Plan as if weekends count. A phishing email clicked on Friday afternoon and spotted on Saturday morning still needs a decision by Tuesday morning.

This article covers what to do once something has gone wrong. Prevention is covered in our guide chapter, How should charities protect themselves from cyber attacks and data breaches?

The 72-hour timeline at a glance

Hours 0–4: contain it without destroying the evidence

The instinct is to switch everything off and start again. Don't. Disconnect affected laptops from the network or turn off their WiFi, but leave them powered on so your IT provider can see what happened. If an email account has been taken over, reset the password from a different, clean device, sign the account out of every session and check for forwarding rules the attacker may have added. If money is involved, such as a changed bank detail on a supplier invoice or a payment sent in error, call your bank straight away. Recovery chances fall by the hour.

Next, call your insurer if you have cyber cover. Many policies have a 24-hour incident line and expect you to use their appointed responders. Bringing in your own before you call them can complicate a claim. Check whether your cover is a standalone cyber policy or a section of a wider one.

Small charities have another option. The Cyber and Fraud Centre – Scotland runs an incident response helpline on 0800 1670 623 (weekdays, 9am to 5pm), which is free for charities with fewer than 20 employees.

Finally, name one decision-maker and open an incident log recording what you knew, decided and did, with times. The ICO, your insurer and your board will all need it.

Hours 4–24: establish what happened, and to whom

By the end of day one you need answers to four questions. What data was affected? Whose data is it: beneficiaries, donors, staff, volunteers? Roughly how many people? Is it still happening?

For charities, the second question carries more weight than it does for most businesses. Support notes, health information, safeguarding records and details about someone's circumstances are often special category data. A donor's email address being exposed is a nuisance. A list of people using a domestic abuse service is a safety risk. The type of data, not the number of records, usually decides how serious the breach is.

Brief your chair or the trustee who leads on risk the same day. OSCR is clear that handling significant events is the trustees' job, so they need to know early, not once the decisions have been made.

Report the crime. In Scotland, cybercrime and fraud are reported to Police Scotland on 101, or 999 if there's an immediate threat. Report Fraud, which replaced Action Fraud on 4 December 2025, covers England, Wales and Northern Ireland but not Scotland.

If the breach is at a supplier, such as a hosted CRM, donation platform or payroll bureau, you're still responsible for your data as the controller. SCVO published guidance for Scottish charities in August 2026 after a cyber incident at a CRM supplier used by many UK charities. Ask the supplier in writing what data was involved and when they found out, and log when you found out.

Hours 24–72: the ICO decision

The legal test is about risk to people, not the size of the breach. The ICO puts it plainly: "If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours." If the risk is unlikely, you don't need to report it, but you must still record the breach and your reasoning internally. Every breach goes in the log, reported or not.

You don't need the full picture before you report: the ICO accepts an initial report, with further details sent later without undue delay. The online form takes about 30 minutes, a self-assessment tool helps you decide, and the breach advice line is 0303 123 1113.

If the risk to people is high, you must also tell them directly, without undue delay. Say what happened, what information was involved, what you've done about it, what they should do (for example, watch for scam calls using their details) and who to contact. For vulnerable beneficiaries, think about how the message is delivered. A call from a known support worker is often better than an email.

If you deliver a service for a council or health board, check your contract. When you process personal data on their behalf, UK GDPR requires you to tell them without undue delay, and many contracts set their own deadline, often shorter than 72 hours. Grant agreements may also require you to tell the funder about incidents that affect delivery or data they've shared. Read the clause rather than guessing.

Do we need to tell OSCR?

Usually not straight away. OSCR replaced its notifiable events process on 1 April 2024. Trustees are now expected to deal with serious issues themselves. OSCR says that if an issue "has been dealt with effectively and the problem has been resolved, there's no need to notify OSCR". If a serious issue can't be resolved, or hasn't been dealt with satisfactorily, trustees should use OSCR's "raise a concern" form.

Cross-border charities are different. If you're also registered with the Charity Commission for England and Wales, its serious incident guidance lists "a significant data breach or loss" as reportable and expects you to report promptly, "as soon as is reasonably possible".

Record your decisions, then learn from them

Once the immediate danger has passed, turn the incident log into a short report for the board: timeline, root cause, who was affected, what was reported and to whom, what it cost and what will change. Add the lessons to your risk register, then test the updated plan. The NCSC's free Exercise in a Box lets a small team rehearse a scenario in an hour or two.

How Indigo does this. Indigo Unified Communications supports more than 30 charities across Scotland from our Glasgow office. Our Charity package includes a 24/7 security operations centre (RocketCyber): a dedicated security team that watches your systems for suspicious activity, including overnight and at weekends. Every support ticket gets a first response in under 30 minutes (13 minutes on average in September 2026), and Microsoft 365 is backed up separately with Datto SaaS Protection, so recovery doesn't depend on the attacker leaving your data alone. IT support for charities →

What to do next

1. Write a one-page incident plan with names and numbers: your IT provider, insurer's incident line, Police Scotland 101, the ICO (0303 123 1113) and the Cyber and Fraud Centre helpline. Print it and keep a copy away from the office.
2. Find the breach notification clauses in your council contracts and main grant agreements, and note the deadlines.
3. Agree now who the decision-maker is, and which trustee they brief.
4. Check whether your insurance includes cyber cover and whether you must use the insurer's responders.
5. Run a one-hour tabletop exercise with the NCSC's Exercise in a Box, then read what funders, insurers and trustees now expect.