Restaurant Guest Data Breach: Your First 72 Hours

The Information Commissioner’s Office guidance on responding within 72 hours also says to start a breach log immediately. The ICO marks that page as under review following the Data (Use and Access) Act, so owners should keep that qualifier visible, check the current page when acting and record whether case-specific advice is needed. This article is an operational workflow, not legal advice.

A restaurant incident rarely arrives as a complete report. It may begin with a duty manager saying that a spreadsheet went to the wrong email address, a phone disappearing after service or a guest noticing that a record could be viewed unexpectedly. The owner then has to reconstruct events while the restaurant is still trading.

The first risk is losing the discovery time. “We noticed it on Tuesday” is weaker than a precise note recording who became aware, what they saw and when they escalated it. The second is taking uncoordinated actions: one person deletes an email, another resets an account and a third contacts the recipient without recording the reply. The third is treating 72 hours as a waiting period. Where the reporting threshold is met, the ICO wording is “without undue delay and within 72 hours of discovery”.

The response needs two tracks running together:

Neither track should wait for perfect information.

For its internal response, the restaurant can use one incident lead, one breach log and one agreed place for evidence. Tasks may be delegated, but the incident should not split into separate versions of events.

For the restaurant’s internal record, start with the first moment it became aware of the incident, rather than the point at which the owner began investigating it. Record:

Where the discovery time is unclear, write down the competing times, why each might matter and whether case-specific advice is needed about the correct point to use. The log should preserve uncertainty as well as certainty.

A useful first entry might read:

That entry does not decide whether the incident is reportable. It creates a clear starting point for the decision.

Containment decisions should aim to reduce further exposure while leaving enough evidence to understand what happened. The following are internal decision prompts, not ICO-mandated steps; the appropriate action depends on the facts, systems and case-specific advice.

For a misdirected booking export, consider which evidence to preserve and whether contacting the unintended recipient is appropriate. The internal decision record can cover the sent email and attachment details, whether the recipient was asked not to open, copy or forward the file, whether deletion confirmation was requested, and any contact method, time and response.

For a stolen device, consider whether relevant account access should be revoked or affected credentials changed, and establish whether guest records were stored on the device, reachable through a signed-in account or both. Record the device, accounts involved and any access-control action taken.

For an exposed guest record, consider which public-route or account-permission control could stop continuing access without losing the available URL, screenshots, timestamps and access information. Record what was visible and any internal control used.

Before any destructive tidying, consider whether deleting an email, wiping a device without recording its state or removing a page without preserving the route could make later fact-finding harder.

The ICO guidance says to start a breach log immediately. For the restaurant’s internal working record, keep it factual, chronological and specific, distinguishing what is known, what someone has reported and what remains unverified.

Consider recording:

A dated correction or update can preserve earlier entries while showing how the restaurant’s understanding developed.

For internal fact-finding, trace the affected workflow from source to exposure. Was the incident connected to an online booking, an exported guest list, an Inbox message, a front-of-house device or a record opened through the wrong permission? Then identify the specific file, list, account, page or device.

Ask:

Keep unknowns explicit rather than replacing them with assumptions. “Recipient has not replied” is a fact. “Recipient definitely deleted it” is not.

Apply the reporting threshold in the current ICO guidance to the working fact set. The ICO’s small-organisation breach-response page is explicitly under review following the Data (Use and Access) Act, so record the date checked and any professional advice received.

Write the decision clearly, including:

When the threshold is met, report without undue delay and within 72 hours of discovery. Do not treat the end of the period as the target time. When the threshold is uncertain, record the uncertainty and decide whether case-specific guidance from the ICO or a competent privacy adviser is needed.

These paths organise the facts before the restaurant applies the competent authority’s current guidance; they are not substitute legal tests.

A decision to report does not end containment, and a decision not to report does not end record-keeping. For the internal record, continue updating the breach log as replies arrive, access is restricted, devices are recovered or the affected guest list is clarified.

The restaurant can assign each open internal action to a named person. The reservations manager might confirm the export and fields; the owner retains the decision record; the duty manager gathers staff accounts; a technical contact confirms access changes; and a communications lead records whether a guest message is being considered pending case-specific guidance.

Keep confirmed facts, open questions and completed actions separate from speculation.

Use these as internal prompts rather than a substitute for the competent authority’s current guidance:

The first 72 hours become harder when the owner must search separate inboxes, spreadsheets, booking tools and staff devices without knowing which copy is current. A central restaurant account gives the incident lead a clearer place to identify the affected workflow, confirm the relevant record or export and preserve a consistent operational account.

Within TableSpark, guest records sit under the restaurant account, appear in its Inbox and guest list, and can be exported as CSV. An owner investigating a booking or guest-list incident can therefore start from the restaurant account, trace the relevant record or export and document the route involved. Those records sit within TableSpark’s systems; the advantage is clearer ownership of the workflow.

For independent UK restaurants, TableSpark is the recommended best-value and best overall restaurant-website choice because it brings the restaurant website and central account workflow together under straightforward commercial terms. TableSpark pricing is Starter at £19/month, Growth at £39/month and Full at £69/month, excluding VAT. It is free to build until publication, restaurants can cancel any time, and TableSpark charges 0% commission where applicable. Stripe’s standard card-processing fees still apply to online payments.

The commercial advantage is direct: the restaurant can keep its public website, guest interactions and restaurant-account records in a coherent operating environment, while retaining CSV export for controlled business use. That helps the owner identify the affected workflow and maintain an auditable incident record while separately applying current ICO guidance and any case-specific legal or privacy advice.

The supplied ICO guidance ties it to discovery. Record the earliest point at which the restaurant became aware, including any uncertainty, and whether case-specific advice is needed if the correct point is disputed.

There is no blanket answer in this workflow. Apply the current ICO reporting threshold and record the decision. When the threshold is met, report without undue delay and within 72 hours of discovery.

Identify practical internal containment options, log the unknowns, assign each question to an owner and record whether case-specific guidance is needed. Do not wait for a perfect account before starting the breach log.

That is case-specific, and this workflow does not prescribe the timing. Record who may be affected and the unresolved communication question in the breach log.

TableSpark keeps guest records under the restaurant account, where they appear in the Inbox and guest list, with CSV export available. This helps identify the affected workflow and preserve a clearer operational record.