Does a hacked Microsoft 365 account need reporting to the ICO?
Assess what happened to personal data and the risk to people. A security alert is not automatically a reportable breach, and a password reset does not settle the question.
Start a decision record
Record the controller and any processor, when the organisation became aware, what information is involved, affected people, likely consequences and the evidence gaps. Distinguish confirmed findings from assumptions. Lack of outbound mail does not establish that personal data was not accessed.
When is the ICO notification required?
Under UK GDPR, notify the ICO unless the personal data breach is unlikely to result in a risk to people’s rights and freedoms. For a notifiable breach, act without undue delay and within 72 hours of awareness where feasible. Record the awareness time and deadline; do not wait for a finished forensic report. Explain delays and provide information in phases when necessary.
What about customers and affected people?
A processor must notify the controller without undue delay. A breach likely to result in a high risk to people requires communication to affected individuals without undue delay, subject to the applicable legal exceptions. Keep a record of all personal data breaches, including those not notified, and explain your decision.
What should a small IT team hand to the decision-maker?
Provide a concise factual timeline, affected systems and accounts, available evidence, actions taken and unanswered questions. Assign a named person to review the risk assessment as evidence changes. Use the incident report template to capture the decision and references to any notifications.
This is a UK-focused operational guide, not a legal determination for your incident. Consult the organisation’s data protection lead or adviser. Other jurisdictions, contracts and sectors can impose additional duties.
Official references
Reviewed 18 October 2026. Portal labels, permissions and licensed features can change; consult the linked documentation.