It also calls for data breach notices to be included in rules, and for broadband providers to be held accountable for any failure to take suitable precautions to protect personal data collected from users.
"In general terms the GDPR's rules around personal data breach reporting recognize that it will not always be possible to investigate a breach fully within 72 hours to understand exactly what has happened and what needs to be done to mitigate it.
The move marks a U-turn for the ICO which originally ruled that no data breach had occurred.
Another thing to note is that new rules incoming in the European Union will set a data breach disclosure standard of 72 hours from May next year.
For now though, Uber faces a compliance patchwork of different national rules across any European Union countries impacted by the data breach.
The data breach is the first that falls clearly under new EU-wide privacy rules which carry beefed up penalties for violations.
But every big tech data breach and security scandal lends weight to the argument that stronger privacy rules are indeed required.
The rules require phone companies and Internet service providers to inform customers of any data breach "without undue delay".
World's Biggest Data Breach.
Kmart suffered a data breach.
