No business can afford to neglect their cybersecurity in an ever-changing environment where the risks are real. Whether you run a small business or have a rapidly growing enterprise, protecting your own data and the data entrusted to you by your partners and clients should be one of your top priorities.
All the data protection provisions of the Data (Use and Access) Act 2025 are now in force, and one of them creates a genuinely new obligation: from 19 June 2026 you must have a complaints procedure, including an electronic form, and acknowledge data protection complaints within 30 days. Separately, Privacy and Electronic Communications Regulations (PECR) penalties rose from a £500,000 cap to UK GDPR levels of £17.5m or 4% of worldwide turnover on 5 February 2026.
Some 43% of UK businesses identified a breach or attack in the past year. Most cost nothing measurable, but all the necessary steps should be taken to avoid a data breach in the first place or handle one swiftly and correctly should one occur.
What is a data breach?
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Note how broad that is. It covers a laptop left on a train, an email sent to the wrong recipient and a spreadsheet deleted with no backup, as much as it covers a criminal breaking into your systems.
That breadth matters because it cuts both ways. Not every cyber attack is a personal data breach, and not every personal data breach is a cyber attack. The single most common reportable incident in most organisations is human error, not hacking.
It is also worth separating three things that often get muddled. A security incident is anything that threatens your systems. A personal data breach is a subset of that, involving personal data, and triggers legal duties. Cyber crime is the criminal offence, which is reported to a different body. One event can be all three, and each has its own reporting route.
How data breaches happen
There are four main causes of data breaches:
Phishing and social engineering. By far the most common attack type, hitting 38% of businesses in the past year. Someone is persuaded to hand over credentials or authorise a payment. It is a people problem with a technical solution attached, which is why training alone does not fix it.
Weak or reused credentials. Passwords guessed, sprayed, or taken from an unrelated breach and tried against your systems. This is what multi-factor authentication is for.
Unpatched software and misconfiguration. Known vulnerabilities in systems nobody updated, or cloud services left open by default. Attackers scan for these continuously.
Human error. Misdirected email, lost devices, documents shared with the wrong permissions, data deleted without a backup. Unglamorous, extremely common, and fully reportable.
Ten ways to protect your business
None of these methods to protect your business are particularly are expensive.
1. Passwords, done the way NCSC now recommends
This is where most advice is now wrong. The old recommended model for passwords was length plus complexity plus regular expiry. The NAtional Cyber Security CEntre (NCSC) has abandoned two thirds of that approach.
On complexity: “Complexity requirements provide no defence against common attacks and should not be used.” On expiry: “Regular password changing harms rather than improves security.” The reasoning is that forcing mixed case, numbers and symbols pushes people towards predictable substitutions, and forcing changes every 90 days pushes them towards incrementing a number on the end.
What to do instead:
Length over complexity. Three random words is NCSC’s recommended approach for memorable passwords, or a password manager generating long random ones.
Use a password manager, and allow pasting into web forms. Do not cap password length.
Deny-list common passwords so the obvious ones cannot be set.
Change only on known or suspected compromise, not on a schedule.
If you want a concrete standard, the UK government-backed certification scheme Cyber Essentials accepts any one of three approaches: multi-factor authentication plus a minimum of eight characters; an automatic deny list plus a minimum of eight characters; or a minimum of twelve characters on its own. Twelve characters is the floor only when you have neither MFA nor a deny list.
2. Multi-factor authentication, and not all of it is equal
MFA is the single highest-value control for most small businesses, and it should be on everything that faces the internet: email above all, then finance systems, remote access and admin accounts.
NCSC ranks the methods. Strongest are FIDO2 credentials and passkeys, which are cryptographically tied to the legitimate site and so cannot be replayed against a convincing fake. Next are challenge-based authenticator apps with number matching, then app-based code generators, then hardware code generators. Weakest are considered SMS, email and voice call, which NCSC says are “only likely to be appropriate when no other strengthening method is possible”.
3. Backups, tested
NCSC calls backups “the most effective way of recovering from a ransomware attack”. No other control on this list can undo damage that has already happened.
NCSC’s guidance, in its own terms: make offline backups kept separate and in a different location, ideally offsite. Do not leave the backup device permanently connected to your network, because malware will reach anything that is attached. Make multiple copies using different solutions and storage locations. Where you use cloud backup, check the service protects previous versions from immediate deletion.
Then two steps almost everybody skips. Test that you can actually restore, because an untested backup is a hope rather than a control. And scan backups for malware before restoring, because ransomware is often resident for weeks before it triggers, so your most recent backup may be infected.
4. Encryption
Encrypt data at rest on laptops, phones and removable media, and in transit. Full-disk encryption is built into current versions of Windows and macOS and costs nothing but the time to turn it on.
There is a specific legal reason to bother, beyond the obvious. If personal data is encrypted to an appropriate standard and the key was not compromised, you may not have to notify affected individuals of a breach at all, because the risk to them is materially reduced.
5. Patching and updates
Turn on automatic updates wherever you can, and treat critical and high-risk patches as urgent rather than routine. Cyber Essentials now requires critical updates to be installed within 14 days, and failing that is an automatic fail on certification.
Include the things people forget: routers and firewalls, printers, phones, plugins and any software that has stopped receiving updates altogether. Unsupported software is a decision, not an accident, and should be recorded as one.
6. Staff training that reflects real attacks
Train people on what an attack actually looks like now: a convincing invoice from a supplier whose email has been compromised, an urgent request from a director, a login prompt that looks exactly right. Make it safe and quick to report a mistake, because the difference between a near miss and a serious breach is usually how fast someone speaks up.
7. Access control and the principle of least privilege
Give people access to what their job requires and no more. Use separate accounts for administrative work rather than granting admin rights to everyday logins, which is the specific failure that let attackers escalate privilege at Capita. Review access when people change role, and remove it the day they leave.
8. Anti-malware and firewalls
Keep anti-malware enabled and current on every device, and use the firewall built into your router and operating system.
9. Suppliers and processors
If someone processes personal data on your behalf, from payroll to your CRM to a cloud host, the law requires a written contract with specific mandatory terms: processing only on your documented instructions, confidentiality, appropriate security, rules on sub-processors, assistance with data subject rights and breach notification, what happens at the end of the contract, and your right to audit.
Two things follow that catch businesses out. The processor must tell you about a breach without undue delay – there is no 72-hour figure for processors – and your own 72-hour clock starts when you find out. So negotiate a tighter contractual window, commonly 24 to 48 hours, because you cannot meet your deadline if you are told late.
And you remain responsible. You have to satisfy yourself the processor is competent before you appoint them, and keep checking. “We outsourced it” is not a defence for either party: the £3.07m fine against Advanced Computer Software in March 2025 was a fine on a processor.
10. Testing, audits and knowing what you hold
You cannot protect data you have not mapped. Know what personal data you hold, where it lives, who can reach it and how long you keep it. Then test: vulnerability scanning, a penetration test if the risk justifies it, and a walk-through of what you would actually do in the even of a breach.
Cyber Essentials
Cyber Essentials is the government-backed baseline standard, and it is remarkably thinly held: only 5% of businesses are certified, against 17% who have even heard of it.
Cyber Essentials covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It is a self-assessment that is independently verified. Cyber Essentials Plus covers the same ground but adds hands-on technical testing by an assessor.
Certification runs through IASME on behalf of NCSC and costs £320 plus VAT for a micro organisation of nine people or fewer, rising to £600 plus VAT for 250 or more. Certificates last twelve months. Organisations with turnover under £20m that certify the whole organisation also get cyber liability insurance included.
Two practical reasons to consider it. Central government contracts involving personal or sensitive data generally require Cyber Essentials or Cyber Essentials Plus, and a growing number of private buyers ask for it in procurement. And the current version, in force from April 2026, makes multi-factor authentication mandatory for cloud services and critical patching within 14 days, both as automatic fails – so working towards it forces the two controls that matter most anyway.
Your legal obligations
The framework is the UK GDPR, the Data Protection Act 2018 and, for electronic marketing and cookies, PECR. The Data (Use and Access) Act 2025 amends all three rather than replacing them, and as of 19 June 2026 all of its data protection provisions are in force.
Four significant changes worth knowing.
A complaints procedure is now a legal requirement. From 19 June 2026 you must make it easy to complain to you about how you handle personal data, including providing an electronic complaints form, acknowledge a complaint within 30 days, take appropriate steps to investigate, and tell the complainant the outcome. Individuals are expected to come to you before going to the ICO. This is the most concrete new obligation for a small business, and it applies whether or not you have ever had a breach.
PECR fines went up sharply. The old £500,000 cap was replaced on 5 February 2026 by the UK GDPR maxima, so nuisance marketing and cookie breaches now carry the same theoretical exposure as data protection breaches. Officer liability also arrives, where a contravention happened with an officer’s consent or connivance or through their neglect.
Recognised legitimate interests. A new lawful basis lets you process without a balancing test for a defined list of purposes: responding to requests from public bodies, national security, emergencies, crime prevention and safeguarding. Read the list before relying on it – it is narrow and largely public interest, and most commercial processing still needs ordinary legitimate interests and a documented balancing assessment.
Automated decision-making is relaxed for decisions made after 5 February 2026, with the tighter regime retained for special category data.
What the fines actually look like
The higher maximum is £17.5m or 4% of total annual worldwide turnover, whichever is higher. The standard maximum, which covers security failings, is £8.7m or 2%.
Those are ceilings, and for a small business the realistic exposure is different. Asked directly whether it will fine small organisations for a breach, the ICO’s published answer is: “No. Fines aren’t suitable for every breach.” It adds that most SMEs are working hard to comply with limited resources, and that where things go wrong it wants to agree improvements and give advice.
The numbers bear that out. In 2025-26 the ICO received 17,431 personal data breach reports, up 40% on the year before, and issued eight penalty notices totalling £32.4m, seven reprimands and two enforcement notices. Seventeen formal actions against more than seventeen thousand reports. Penalties cluster at the top end – Capita at £14m, Advanced Computer Software at £3.07m, 23andMe at £2.31m – while reprimands and enforcement notices are the realistic outcome further down.
That is a reason to report promptly rather than a reason to relax. What is important to the ICO is whether you had reasonable controls and how you responded.
What to do if it happens
Speed matters when it comes to discovery of a breach. Here’s what to do:
1. Contain it. Isolate affected systems, revoke compromised credentials, and preserve logs rather than wiping and rebuilding immediately, because you will need them to work out what happened.
2. Work out what was affected. Which personal data, how many people, and what harm could follow. This assessment drives everything after it.
3. Report to the ICO within 72 hours – of becoming aware, not of the breach happening. The obligation runs from the point you become aware of it. You must report unless the breach is unlikely to result in a risk to people’s rights and freedoms, which is a low bar, so the default for anything non-trivial is to report. If you are unsure, the ICO has a self-assessment tool. You do not need the full picture first: report what you have and provide the rest without undue delay.
4. Tell affected individuals if the risk is high. A higher threshold than reporting to the regulator, and there is no fixed deadline beyond “without undue delay”. You may not need to if the data was appropriately encrypted, if you have since removed the high risk, or if it would take disproportionate effort – in which case make a public communication instead.
5. Log it either way. You must document every personal data breach, including ones you decide not to report, with the facts, the effects and the remedial action taken. The ICO can ask to see that record, and an empty breach log at inspection is its own problem.
6. Report the crime, separately. For cyber crime, report through Action Fraud in England, Wales and Northern Ireland, or Police Scotland on 101 in Scotland. Serious incidents can also go to NCSC. Note that reporting a cyber incident through the government’s signposting service does not notify the ICO – the routes are parallel, not alternatives, and only an ICO report discharges your data protection duty.
7. Fix and record. Close the vulnerability, and write down what you changed. That record is the most useful thing you will have if the ICO asks questions.
On paying a ransom
Paying is not in itself a criminal offence in the UK, but three things constrain it. Sanctions law is the sharpest risk, since many ransomware groups are designated and making funds available to a designated person can be an offence regardless of what you knew; terrorist financing and money laundering offences can also apply. There is currently no ban in force, though the government confirmed in July 2025 that it intends to develop one for the public sector and critical national infrastructure.
And payment will not help you with the regulator. The ICO and NCSC have said jointly that the ICO “does not consider the payment of monies to criminals who have attacked a system as mitigating the risk to individuals and this will not reduce any penalties incurred through ICO enforcement action”. What does count is understanding the incident, reporting it, and showing you followed recognised guidance.
In summary
The controls that prevent most breaches are dull and cheap: multi-factor authentication on email, patching inside two weeks, offline backups you have actually restored from, least-privilege access, and knowing which suppliers touch your data. Get involved with Cyber Essentials packages as these are likely to cost your less than a day of consultancy.
Three things to change today if you change nothing else. Stop enforcing password complexity and scheduled expiry, because NCSC’s position is that both make you less safe. Put a data protection complaints procedure and an electronic form in place, because that has been a legal requirement since June 2026. And make sure you test a restore from backup, because the day you need it is the worst day to find out it does not work.
No business can afford to neglect their cybersecurity in an ever-changing environment where the risks are real. Whether you run a small business or have a rapidly growing enterprise, protecting your own data and the data entrusted to you by your partners and clients should be one of your top priorities.
All the data protection provisions of the Data (Use and Access) Act 2025 are now in force, and one of them creates a genuinely new obligation: from 19 June 2026 you must have a complaints procedure, including an electronic form, and acknowledge data protection complaints within 30 days. Separately, Privacy and Electronic Communications Regulations (PECR) penalties rose from a £500,000 cap to UK GDPR levels of £17.5m or 4% of worldwide turnover on 5 February 2026.
Some 43% of UK businesses identified a breach or attack in the past year. Most cost nothing measurable, but all the necessary steps should be taken to avoid a data breach in the first place or handle one swiftly and correctly should one occur.
