Despite all security measures, it can happen: a hacker attack, a document sent by mistake, a lost laptop. This is when the GDPR data breach notification obligation applies. Where there is a risk to the individuals affected, companies must inform the supervisory authority within 72 hours and possibly the affected individuals themselves. Anyone who tries to cover up a data breach risks even higher fines. In this article you will learn which incidents must be reported, how the notification process works and how good preparation minimises the damage.
Key points: GDPR data breach notification
- Definition of a data breach: a personal data breach
- 72-hour deadline for notifying the authority
- Informing affected individuals: in case of high risk
- Emergency plan: decide in advance who acts and how
1. What is a data breach under the GDPR?
Art. 4 No. 12 GDPR defines a “personal data breach” as destruction, loss, alteration or unauthorised disclosure of, or access to, data. Examples:
- Hacker attack: Cyber criminals gain access to customer data.
- Wrong recipient by mistake: An email with sensitive attachments goes to an outside address.
- Lost or stolen devices: A laptop with an unencrypted hard drive is lost.
2. When is notification mandatory?
Within 72 hours to the supervisory authority if there is a risk to the rights and freedoms of the individuals affected.
- High potential for harm: e.g. passwords, credit card data, health information.
- Low risk: Internal documentation may be enough, with no external notification.
You have to assess the risk, ideally in consultation with your data protection officer.
3. How the notification works
- Discovery: An employee reports the incident to the data protection team or the data protection officer.
- Immediate measures: Close the gap, for example by blocking email access and resetting passwords.
- Risk assessment: How likely is misuse? Which data is affected?
- Notification to the authority: Contents: nature of the breach, categories of data and individuals affected, estimated number, remedial measures.
- Notification of affected individuals: If there is a high risk to personal rights, such as identity theft. Give affected individuals tips on how they can protect themselves.
Link: BfDI, the German Federal Commissioner for Data Protection
4. Tips for your emergency plan
- Keep the contact details of the supervisory authorities at hand (in Germany, the data protection authority of the relevant federal state).
- Checklist: Who informs whom? IT blocks access, the data protection officer gathers information, the managing director authorises the notification.
- Communication strategy: Openness pays off. A cover-up leads to higher penalties if it comes to light after all.
- Documentation: Record everything you do, in writing or digitally (time, measures, people involved).
5. Common mistakes: GDPR data breach notification
- Notifying too late: The 72-hour deadline starts as soon as you become aware of the breach, not only after an internal clarification.
- No awareness of risk: Many underestimate the consequences of a breach (e.g. the risk of doxxing for affected individuals).
- Unclear responsibilities: Nobody knows who should act.
- No training: Employees recognise phishing or data leaks too late.
Link: IHK Halle-Dessau: data protection guidance (in German)
FAQ: GDPR data breach notification
Only if there is a high risk. If the risk is low, a notification to the supervisory authority or just internal documentation is enough.
The risk may be low, but you should review the incident. To be on the safe side, an informal notification to the authority can be advisable (better safe than sorry).
To the competent supervisory authority (in Germany, the data protection authority of the federal state concerned). If your company is based in several federal states, a lead authority may be responsible.
