An ICO spokesperson said:
“Capita has reported an incident to us and we are assessing the information provided.
“Other organisations who are affected should also consider their position and report data breaches where necessary. Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people’s rights and freedoms.
“If an organisation decides that a breach doesn’t need to be reported they should keep their own record of it, and be able to explain why it wasn’t reported if necessary.”
