Personal data breach: the 72-hour rule and what to do

An email sent to the wrong recipient, a lost laptop, a compromised account, a database exposed by a misconfiguration. All of these are personal data breaches in the sense of the GDPR, and the law gives you a short time to react. This guide explains what to do in the first hours and what to keep afterwards.

#What is a personal data breach?

Article 4(12) defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It covers three kinds of problem:

• Confidentiality: someone who should not see the data does.
• Integrity: the data was changed when it should not have been.
• Availability: the data was lost or cannot be accessed, including by ransomware.

It is not only hacking. A misdirected email with a customer list is a breach.

#The 72-hour rule

Article 33(1) says that, in the case of a breach, the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If you notify after 72 hours you must give the reasons for the delay.

"Aware" is read by the European Data Protection Board as having a reasonable degree of certainty that a security incident has led to personal data being compromised. The clock does not start with the first suspicion, but you should investigate immediately, because waiting to be sure is not an excuse.

The 72 hours include weekends. If you are a processor, you must notify the controller without undue delay after becoming aware (Article 33(2)), so that it can meet its own deadline.

#Step by step

#1. Contain it

Stop the damage: reset passwords, revoke access, recall the email, take the exposed system offline. Write down what you did and when.

#2. Record when you found out

Note the exact date and time you became aware, who found it and how. This starts the clock and is the first thing a regulator asks.

#3. Establish the facts

What data, whose, how many people and records, how it happened, whether it is still happening, and whether the data was protected, for example by encryption.

#4. Assess the risk

Consider the likely harm to the people concerned: identity theft, fraud, discrimination, loss of confidentiality, distress. The more sensitive the data and the easier it is to identify people, the higher the risk. Risk is judged for the individuals, not for your business.

#5. Notify the authority, if there is a risk

Article 33(3) lists what the notification contains: the nature of the breach with the categories and approximate number of people and records, the contact point, the likely consequences and the measures taken or proposed. If you do not have everything within 72 hours, you can send the information in phases.

#6. Tell the people affected, if the risk is high

Article 34 requires you to communicate the breach to the individuals without undue delay when it is likely to result in a high risk, in clear and plain language, with what happened, the likely consequences, what you are doing and what they can do. You do not have to if the data was unintelligible to others (for example strongly encrypted), if you took measures that make the high risk unlikely to materialise, or if it would involve disproportionate effort, in which case a public communication is needed.

#7. Record it and learn from it

Article 33(5) requires you to document every breach, whether or not you notified, with the facts, its effects and the remedial action. The register is what lets the authority check you decided correctly. Afterwards, fix the cause: training, access rights, a process change.

#Who do you notify, and in which country?

In the EU, the competent authority is generally the one in the country of your main establishment. Outside the EU, deadlines and recipients vary: for example, the UK also uses 72 hours, Brazil's ANPD expects notice within three business days, and in Canada the duty is "as soon as feasible" when there is a real risk of significant harm. If you serve several countries, check each one.

#What fines look like

Failing to notify or record a breach can be fined up to €10 million or 2% of worldwide annual turnover under Article 83(4). The breach itself, if it shows inadequate security, can be fined more severely under Article 83(5). Authorities weigh cooperation, speed and the measures taken, which is another reason to act quickly and document everything.

#FAQ

#Do I have to report every data breach?

No. You must record every breach, but you only notify the authority when it is likely to result in a risk to people. A breach unlikely to cause any harm, such as lost encrypted data with a safe key, is recorded but not notified.

#When does the 72-hour clock start?

When you become aware that a breach has occurred, meaning you have a reasonable degree of certainty that personal data was compromised.

#What if I cannot finish my investigation in 72 hours?

Notify with what you know and complete the information in phases. A late or partial notification is better than none.

#Do I have to tell my customers?

Only when the breach is likely to result in a high risk to them, or if your contract or another law requires it. Tell them promptly and clearly, with practical steps they can take.

#Does a ransomware attack count as a breach?

Yes. Encrypted data you cannot access is an availability breach, and attackers often copy the data first, which is a confidentiality breach too.

#Do I need a breach register if I have had no breaches?

You must document breaches when they happen. Having the register ready, with a simple form to fill in, makes the first hours easier.

#Sources

• Regulation (EU) 2016/679 (GDPR), Articles 4(12), 33, 34 and 83, EUR-Lex
• EDPB Guidelines 9/2022 on personal data breach notification under the GDPR