Eleven days from identifying the incident to telling anyone. The 72 hour clock is a different clock

Two dates, and a deadline that is not between them

Dyfed-Powys Police identified a cyber incident on 14 September 2026. It made the incident public on 25 September. That is eleven days.

The force says the incident disrupted some non-emergency systems, that it remains fully operational, and that 999 and 101 were not affected. It says there is no evidence that personal data belonging to members of the public has been accessed, and that it is still investigating whether staff information was compromised. The investigation is being managed by Tarian, the regional organised crime unit for southern Wales. The Information Commissioner's Office confirms it has received a breach report and is "assessing the information provided".

Whenever a gap like eleven days appears, somebody points at seventy two hours. It is worth being exact about what that deadline is, because almost everybody cites it wrongly, including people who write policy.

What the eleven days does not establish. It does not establish that any deadline was missed. The ICO's clock is a reporting obligation to the regulator, and the ICO has confirmed it holds a report without saying when it arrived. It does not establish that staff data was taken, because the force says that is what it is still investigating. It does not establish the scale, because no numbers have been published. And it does not establish that the force was slow: an eleven day gap between identifying something and being able to say anything accurate about it is ordinary in incident response, and saying something wrong earlier is worse.

What the law actually requires

The ICO's own guidance sets out two separate duties with two different thresholds, and the difference is the whole point.

To the regulator. "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." The threshold is whether a risk to people's rights and freedoms is likely. If a risk is unlikely, there is no duty to report at all.

To the people affected. A higher bar: it applies where a breach is "likely to result in a high risk to the rights and freedoms of individuals", and then the requirement is to tell them "directly and without undue delay".

To the public. There is no such duty. Nothing in the regime requires an organisation to make a statement to the press, to publish a notice, or to confirm an incident at all. Organisations do it because of operational disruption people can see, because of media enquiries, because of their own transparency commitments, or because affected individuals will find out anyway.

So the seventy two hours everybody quotes is the first of those three, and the eleven days in this case is the third, which has no clock attached to it.

The three notifications people conflate, from the ICO's own guidance on personal data breaches.

Who is told	The trigger	The deadline
The ICO	A risk to rights and freedoms is likely	Without undue delay, and within 72 hours of becoming aware
The individuals affected	A high risk to rights and freedoms is likely	Directly, and without undue delay
The public	No statutory trigger	None

There is a fourth obligation worth naming for anyone in this sector, because it is the one that is changing. Organisations in scope of the UK's network and information systems rules, and those that will fall under the incoming resilience regime, carry incident reporting duties that are separate again from data protection: they are triggered by disruption to the service rather than by exposure of personal data, and they run to a different regulator on a different clock.

A police force is not a typical example of that, but the structural point holds for the readers of this site who run utilities, health services, finance or digital infrastructure. It is entirely possible to have one incident, three regulators, and three different definitions of when the clock started.

Whose data this is

Look again at the shape of the reassurance. No evidence that the public's data was affected. Still investigating whether staff information was.

That is an honest statement and it is also the wrong way round from the perspective of risk. For most organisations, employee data is the less sensitive category: names, contact details, payroll references. For a police force it is not.

The staff of a police force include officers whose home addresses, family details and shift patterns have a direct bearing on their physical safety, and who may be working on investigations where their identification matters to the people being investigated. Exposure of that information is a different kind of harm from exposure of a customer list, and it does not become smaller because the public is unaffected.

This is not a criticism of the wording. A force reassuring the public it serves is doing the obvious and correct thing. But a reader assessing the seriousness of the incident should notice that the category still under investigation is the one where the consequences are worst.

What to do about it

The question this leaves

Nothing here suggests wrongdoing. A force identified something, kept emergency services running and isolated, involved the regional organised crime unit, notified the regulator, and said what it knew when it could say it. The eleven days are not evidence of concealment; they are what it takes to have something accurate to say.

What the case is useful for is the vocabulary. Seventy two hours is a duty owed to a regulator, on a test of likely risk. Telling people is a separate duty, on a higher test. Telling the world is not a duty at all, which is precisely why the timing of it is a judgement that organisations should make deliberately rather than discover under pressure.

So the question for your own plan: when your incident happens, who exactly is the seventy two hours owed to, who decides when the public is told, and have those two people ever met?