Personal data breach at your company: what to report within 72 hours
You notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The only exception is a breach unlikely to result in a risk to people. If the risk is high, you also tell the people yourself. You document every breach (Art. 33 and 34 GDPR).
When do you have to report a data breach?
The GDPR calls it a “personal data breach” (Art. 4(12)). It means a breach of security that leads to personal data being destroyed, lost, altered or disclosed without authorisation, or to someone accessing it without authorisation. A mistake counts as much as an attack.
The European Data Protection Board (EDPB) gives examples: a lost device with customer data, data encrypted by ransomware, an email sent to the wrong mailing list. A temporary outage counts too if it leaves data unavailable.
As controller, your company notifies the breach without undue delay and, where feasible, within 72 hours of becoming aware of it. That does not apply if the breach is unlikely to result in a risk to people's rights and freedoms. If you notify later, give the reasons for the delay (Art. 33(1)).
Art. 4(12) · Art. 33(1) GDPR
When do the 72 hours start?
The clock starts when your company becomes aware of the breach, not when it happened. According to the EDPB, that is the moment you have a reasonable degree of certainty that a security incident has compromised personal data. A short investigation is allowed, but it should start at once.
If the breach happens at a service provider that processes data on your behalf, it tells you without undue delay (Art. 33(2)). According to the EDPB you are, in principle, aware once it has told you. Then it is for you to notify.
If part of the information is still missing after 72 hours, notify what you know and provide the rest in phases (Art. 33(4)).
Art. 33(2) and (4) GDPR
What goes into the notification, and who receives it?
The notification states at least the nature of the breach, where possible with the categories and approximate number of people and records concerned. It also names a contact point such as the data protection officer, the likely consequences and your measures (Art. 33(3)). According to the EDPB, missing exact figures should not hold up the notification.
In Germany, companies usually notify the data protection authority of their federal state (§ 40 BDSG). Look up its reporting channel before you need it.
You document every breach, including one you do not notify: the facts, its effects and the remedial action taken (Art. 33(5)). The EDPB recommends also recording why you did not notify.
Art. 33(3) and (5) GDPR · § 40 BDSG
When do you have to tell the people affected?
If the breach is likely to result in a high risk to people, you tell them yourself without undue delay (Art. 34(1)). That threshold is higher than the one for notifying the authority.
The message explains in clear and plain language what happened and names the contact point, the likely consequences and your measures (Art. 34(2)). The EDPB advises also saying what people can do themselves, such as changing their password.
It is not needed if the data was unintelligible to anyone unauthorised, for example through encryption, or if you have since removed the high risk. If it would take disproportionate effort, a public communication takes its place (Art. 34(3)).
Art. 34 GDPR
An example: an attack on the file server
The fictional Hansen Logistik GmbH has 140 staff and an external data protection officer. On Monday at 7:40 its file server is encrypted, personnel files included. So the company is aware of a breach, and the 72 hours run until Thursday, 7:40.
At 11:00 the logs show that bank details and sick notes were taken. Management and the data protection officer therefore rate the risk as high. On Tuesday the notification goes to the state authority, and every employee gets a message in plain language.
Two mistakes would be easy here. The company waits for the investigation to finish, although it may add details later. Or it reports only to the BSI. If the company falls under NIS 2 and the attack is significant, it calls for an early warning there within 24 hours (Art. 23(4) NIS 2, § 32 BSIG). But NIS 2 leaves the GDPR untouched (Recital 14), and the notification under Art. 33 to the data protection authority remains your own.
Our article on a data leak under NIS 2 and the GDPR explains how the two notifications run side by side.
With an AI assistant
An AI assistant such as Claude, ChatGPT or Copilot can draft the notification under Art. 33(3) from your incident notes. It structures the entry for your documentation and puts the message to the people affected into plain language.
Whether there is a risk or a high risk is your company's decision as controller. Where a data protection officer is designated, the EDPB recommends involving them from the start.
Your notes often contain personal data themselves; check first that a data processing agreement with the assistant's vendor is in place (Art. 28 GDPR). A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.
What the NIS 2 walkthrough already records
Two items prepare for an emergency under NIS 2 and point to Art. 33 GDPR along the way; they do not cover the GDPR duties themselves.
3.1 Plan what happens in an incident: the incident response plan the walkthrough writes from your answers says under “Reporting to the authority” that if personal data is affected, you usually also notify the data protection authority, where feasible within 72 hours (Art. 33 GDPR).
Under “Your emergency contacts” in 3.1, the walkthrough suggests the data protection officer as a contact. According to the plan, the person who leads in an emergency decides whether to report and notes every decision with the time. Management approves the plan in 7.3.
3.3 Know how to report an incident: the deadlines for reporting to the authority under Art. 23(4) NIS 2. Under “Often missed” it says that a personal data breach usually also goes to the data protection authority.
Not in the walkthrough: the documentation under Art. 33(5), the assessment of the risk to people and the message under Art. 34.
Common questions
Do I have to report a data breach that happened at our service provider?
Yes, on the same conditions as a breach in your own house, if the provider processes the data on your behalf. It must tell you without undue delay (Art. 33(2)). According to the EDPB it can notify for you if your contract provides for it; the responsibility stays with you.
Is ransomware always a reportable data breach?
It is a breach as soon as personal data becomes unavailable; whether you notify depends on the risk. In one EDPB example the malware merely encrypts, nothing is taken, and the backup restores everything in good time. Then no notification is needed, but documentation is.
An email went to the wrong recipient: is that a data breach?
If it contained personal data, yes: it is an unauthorised disclosure. If it went to a known supplier who deletes it at your request, the EDPB says the risk may be low enough that no notification is needed. The case is documented all the same.
What happens if we miss the 72 hours?
You notify anyway, as soon as you can, with the reasons for the delay (Art. 33(1)). The duty does not end with the deadline. Record why it took longer; the EDPB advises that too.
Does the notification duty apply to small companies too?
Yes. Art. 33 GDPR applies to every controller, with no exception by size. Without a data protection officer, you name another contact point in the notification (Art. 33(3)(b)).
Read next
- Data breach — NIS 2 and GDPR in parallelTwo supervisors, two clocks, one investigation: how Article 23 NIS 2 and Article 33 GDPR run in parallel.
- NIS2 reporting obligation: when and how to report incidents to the BSIEarly warning within 24 hours, notification within 72 hours, final report after one month (§ 32 BSIG).
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 4(12), Art. 28, 33 and 34, CELEX 32016R0679, publications.europa.eu
- European Data Protection Board, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 of 28 March 2023, edpb.europa.eu
- Federal Data Protection Act (BDSG), § 40, gesetze-im-internet.de
- Directive (EU) 2022/2555 (NIS 2), Recital 14 and Art. 23(4), publications.europa.eu, and BSI Act (BSIG), § 32(1), gesetze-im-internet.de
- open-isms, messages/durchgang (items 3.1, 3.3 and 7.3) and lib/durchgang/nis2.ts, github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
In the works
The GDPR walkthrough
After the NIS 2 walkthrough, nisd2.eu is building a GDPR walkthrough. It will work with the same MCP server, so your own AI assistant can fill it in too. We are not naming a date yet. Join the waitlist and we will write to you once it is ready.
With a free account on nisd2.eu. You can leave the waitlist at any time on the same page.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
