Data breach: the 72 hours that matter

The GDPR sets precise obligations in the event of a personal data breach. Well prepared, those 72 hours are manageable; improvised, they are costly.

1. Contain and document

Cut access, change passwords, isolate affected systems. Write down the facts immediately: what, when, how many people, which data. Every breach must be recorded in an internal register (Article 33(5) GDPR), even if it is not notified.

2. Assess the risk

The key question: does the breach pose a risk to the rights and freedoms of the people concerned? Encrypted, unusable data poses little risk; exposed health or banking data poses a high one.

3. Notify the Data Protection Authority

If there is a risk, the DPA must be notified within 72 hours of becoming aware of the breach (Article 33). If not all information is available yet, it can be provided in phases.

4. Inform the people concerned

If the risk is high, the people concerned must be informed without undue delay, in plain language (Article 34): the nature of the breach, likely consequences, measures taken, practical advice.

Prepare a one-page procedure today: who decides, who contacts whom, which notification template. It’s the best insurance against panic.