Reporting a Data Breach

Home › IT Law › Data Protection › Reporting a Data Breach

A laptop goes missing, an email with customer data reaches the wrong distribution list, attackers encrypt your servers: from that point the notification deadline under Art. 33 GDPR is running. This page sets out what to do in the first hours. We support controllers and processors with assessment, notification and communication, at short notice if necessary.

Data breach: immediate steps

1. Contain the incident: isolate affected systems, block access, reset passwords. Do not rebuild systems too early, as evidence will be lost.
2. Record the time you became aware of the breach. The 72 hours run from that moment.
3. Involve the data protection officer, IT security and management. A processor must inform the controller without undue delay.
4. Collect the first facts: which data, how many people, which systems, since when, has the access ended.
5. Assess the risk and decide on notification to the authority, notification of data subjects and other reporting duties.
6. Notify in time, with provisional information if necessary, and document the entire process.

Notification under Art. 33 GDPR: the 72-hour deadline

A personal data breach occurs where data is destroyed, lost, altered, or disclosed or made accessible without authorisation (Art. 4(12) GDPR). Intent or fault is irrelevant. A single misdirected email can be enough.

The controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The deadline also runs over weekends and public holidays. Awareness exists once it is reasonably certain that an incident affects personal data; a longer internal review does not postpone the start. Late notifications must be justified. Missing information may be provided in phases (Art. 33(4)). The notification must at least describe the nature of the breach, the categories and approximate numbers of data subjects and records, the DPO’s contact details, the likely consequences and the measures taken or planned (Art. 33(3)).

Risk assessment: when to notify the authority and data subjects

Notification is only unnecessary if the breach is unlikely to result in a risk to the rights and freedoms of individuals. This exception is narrow. Relevant factors are the type and sensitivity of the data, the number of people affected, identifiability, possible consequences such as identity theft, fraud or reputational harm, and whether the data was effectively encrypted.

If the breach is likely to result in a high risk, the individuals concerned must also be informed without undue delay, in clear and plain language (Art. 34). This typically applies to health, banking or login data and to publication on the dark web. Exceptions apply, for example, where effective encryption was in place.

Documentation and competent authority

Every breach must be documented internally under Art. 33(5) GDPR, even if it is not notified, including the reasons for the decision. In damages litigation this record regularly becomes the key piece of evidence. For private bodies, the competent authority is usually the data protection authority of the federal state where the company is based, in Lower Saxony the LfD Niedersachsen in Hanover. For telecoms and postal service providers it is the Federal Commissioner for Data Protection and Freedom of Information (BfDI). In cross-border processing, the main establishment notifies the lead authority (Art. 56).

Parallel reporting duties: NIS2, TKG, DORA

Contractual duties to inform customers and clients, and obligations towards the cyber insurer, come on top. Notifications to authorities and letters to data subjects, customers and the press must be consistent, as contradictions are later used against the company in fine and damages proceedings.

Consequences: fines and damages

Failure to notify, or late notification, can lead to fines of up to EUR 10 million or 2 per cent of worldwide annual turnover (Art. 83(4) GDPR). Affected individuals can claim damages under Art. 82; according to the CJEU and the German Federal Court of Justice, loss of control over data alone can constitute non-material damage.

Frequently asked questions

Must I notify before I know everything?

Yes. Notify within the deadline on the basis of what you know and announce follow-up information. A precautionary notification does less harm than a late one.

Can a notification be used against us?

In criminal and administrative fine proceedings only with the consent of the person notifying (Section 42(4), Section 43(4) BDSG). This protection does not apply in relation to data subjects, so the notification should be factual and precise.

What if our service provider was hacked?

The duty to notify lies with you as controller. Your deadline starts when the processor informs you. Check the data processing agreement for cooperation and cost provisions.

Related topics

• Cyber attack: immediate measures
• NIS2 (in German)
• Fines and damages (in German)
• IT security law
• Cybercrime (in German)