Overview
When a UK organisation suffers a personal data breach, the 72-hour ICO reporting clock starts when you become aware of it. Our responders help you contain the incident, establish the facts quickly and give your DPO, legal advisers and insurer the evidence they need to decide on notifications.
Whether it's ransomware, a business email compromise, a data leak or a suspicious alert you can't explain, the first hours of an incident shape the outcome. Decisions about containment, evidence and communication made under pressure are hard to undo.
Our responders guide containment, coordinate investigation across endpoints, servers, cloud and email, and support eradication, recovery and hardening so the same path can't be used again. Deep forensic investigation and malware analysis are delivered by our Digital Forensics team as part of the response.
We provide clear reporting for leadership, insurers, legal counsel and regulators — including support for time-bound obligations such as 72-hour ICO personal data breach reporting under UK GDPR.
Incident response for UK organisations
- Facts gathered quickly so your DPO can decide on 72-hour ICO breach reporting
- We work alongside your insurer's appointed responders and legal advisers where a policy requires it
- Support with NIS Regulations reporting and with reporting cyber crime to Action Fraud or Police Scotland
- Clear executive summaries for boards, customers and regulators, written in plain English
What's included
Our approach
- EngageInitial call, scoping and immediate containment advice.
- PreserveCollection of logs, images and artefacts with chain of custody.
- InvestigateTimeline reconstruction, root cause and data-impact assessment.
- Eradicate & recoverRemoval of attacker access and safe restoration.
- LearnPost-incident report and prioritised improvement plan.
What you receive
- Incident timeline and root cause
- Containment and recovery actions
- Retainer onboarding pack
- Tabletop exercise reports
- Executive, technical and regulatory reports
Standards & frameworks
- NIST SP 800-61
- ISO/IEC 27035
- NIS Regulations 2018 incident reporting
- UK GDPR Art. 33 (72-hour ICO reporting)
- NCSC incident management guidance
Frequently asked questions
We think we've been breached — what should we do first?
Avoid powering off affected systems or wiping evidence, isolate them from the network where possible, preserve logs, and contact us immediately using the details on our contact page.
Can you work with our cyber insurer?
Yes. We can coordinate with insurers and legal counsel and produce reports suited to claims and legal review.
Do you offer incident response retainers?
Yes. A retainer pre-agrees terms and onboarding so responders can start immediately when you need them.
Can you help with ICO breach reporting?
We help you establish the facts the ICO asks for, such as what happened, what data and how many people were affected, and what you have done in response, so that your DPO or legal adviser can decide whether a report is required within 72 hours. The decision to notify, and the notification itself, remain yours.
Can you support UK organisations from India?
Yes. All services are delivered remotely by our team in India. India is 4.5 hours ahead of UK time during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps with yours every morning and afternoon. Testing windows and escalation contacts are agreed around your UK schedule, and 24/7 services run around the clock.