A personal data breach: what to do in the first 72 hours and the data protection officer’s role

An accountant sends the payroll records of all employees to an external supplier by mistake. A salesperson’s unencrypted laptop with a client list is stolen from a car. An e-shop discovers in the morning that an attacker has downloaded the customer database. All three are personal data breaches, and in all three a period begins to run which the GDPR gives the controller to respond. The decisions taken in the first hours then determine how the authority, and the individuals concerned, will view the incident.

What is a personal data breach

The GDPR defines it broadly: a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data, or unauthorised access to it (Article 4(12)). It need not be a hacker attack. A misaddressed email, a lost USB key or a document accidentally shared publicly are breaches just as much as a database leak.

Notifying the authority

The basic duty reads as follows:

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

— Article 33(1) of Regulation (EU) 2016/679 (GDPR)

For a company operating only in Slovakia, the competent authority is the Office for Personal Data Protection of the Slovak Republic. Three practical points follow from the text. The first is that the period runs from the moment the controller became aware of the breach, not from its full investigation. The second is that no notification is needed if the breach is unlikely to result in a risk to individuals; that assessment must, however, be reasoned and recorded. The third is that the notification may be provided in phases where all the information is not immediately available (Article 33(4)).

The notification contains in particular a description of the nature of the breach, including the categories and approximate number of data subjects and records, the contact details of the data protection officer or other contact point, a description of the likely consequences and of the measures taken or proposed (Article 33(3)). Every breach, including one that is not notified, must be documented by the controller so that the authority can later verify that it acted correctly (Article 33(5)).

If the breach occurs at a processor, for instance a cloud provider or a payroll agency, the processor must notify the controller of the breach without undue delay (Article 33(2)). Since the controller’s period runs only from its own awareness, it is worth agreeing a specific short period and the content of the report in the contract with the processor.

Informing the individuals concerned

If the breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must also communicate it to them without undue delay. The communication describes the nature of the breach in clear and plain language and contains at least the contact details of the data protection officer, the likely consequences and the measures taken or proposed (Article 34(1) and (2)). The duty falls away if the data were protected, for instance by encryption, if subsequent measures have removed the high risk, or if individual communication would involve disproportionate effort; public communication then applies instead (Article 34(3)). The authority may also order the data subjects to be informed (Article 34(4)). An encrypted laptop may therefore mean no more than an entry in the incident records, whereas an unencrypted one with a client list and their birth numbers may lead to a duty to inform each of them.

The data protection officer’s role

If the company has a data protection officer, they are the natural coordinator during an incident. They cooperate with the supervisory authority and act as its contact point (Article 39(1)(d) and (e)), their contact details are given directly in the notification, and data subjects may contact them with all questions about processing (Article 38(4)). The data protection officer assesses the risk and prepares the supporting materials and the wording of the notification; the decision to notify and the responsibility for it nevertheless remain with the controller. A company without a data protection officer needs to have decided in advance who will take on that role in the first hours.

Where a cyber incident is also involved

An essential service operator under the Cybersecurity Act reports a serious cybersecurity incident through a separate procedure: an early warning within 24 hours at the latest and a notification generally within 72 hours at the latest of its detection (Section 24(3) of Act No. 69/2018 Coll.). That report is governed by different legislation and the GDPR does not regulate it, so if the incident also affected personal data, both duties must be assessed separately. The procedure following a cyberattack is described in to whom and by when to report a cyber incident, and the implications for contracts with IT suppliers in NIS2 does not end at registration.

The procedure in brief

1. Stop the incident and secure the evidence, without deleting logs.
2. Record the time at which the company became aware of the breach and start keeping a record of the steps taken.
3. Assess what data and how many people are affected and what risk that poses to them.
4. Decide on notifying the authority and, where the risk is high, the data subjects as well, and give reasons for the decision.
5. Adopt remedial measures and document them.

How the authority calculates a fine for a breach, and why the mandatory notification itself is assessed neutrally, is explained in how the authority calculates a GDPR fine. We prepare the incident response plan, processor contracts and template notifications through our GDPR and personal data protection service. If you want someone on hand during an incident to take over coordination and communication with the authority, see our data protection officer (DPO) as a service.