The first hours
- Contain the breach: stop the leak, secure the accounts, keep the evidence.
- Bring in the breach team and the data protection officer.
- Establish when you became aware: the 72 hours run from then.
- Find out what data, how many people, and what the consequences might be.
What the notification contains (Article 33(3))
- The nature of the breach, categories and approximate number of people and records.
- The contact point.
- The likely consequences.
- The measures taken or proposed.
If you do not know everything yet
Notify on time and complete it in phases, as Article 33(4) allows. If you notify later than 72 hours, you must give the reasons for the delay.
The EU's Digital Omnibus proposal would change how breaches are reported. Check its status against the current text of the GDPR.
When to inform the people concerned
Article 34 requires telling them without undue delay when the breach is likely to result in a high risk to them, in clear language, with what they can do to protect themselves.
Keep a record of every breach
Article 33(5) requires documenting all breaches, even those not notified: the facts, the effects, the measures and the reasoning behind your decision.
Questions
- When does the 72-hour period start?
- When you become aware of the breach, that is, when you are reasonably certain that personal data was compromised.
- Do processors notify the authority?
- A processor must inform the controller without undue delay (Article 33(2)). The controller notifies the authority.
- Is every breach notifiable?
- No: not if it is unlikely to result in a risk to people. The decision and its reasons must still be recorded.