Data breach: what to do in the first 72 hours

A data breach must be reported to the data protection authority within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to the people concerned. Every breach must be documented, including those you do not report.

Data breaches rarely look like a film scene. Usually it is an email with a customer list sent to the wrong address, a laptop forgotten on the train, or a mailbox taken over through phishing. What matters then is a clear head and a clear order of steps.

What counts as a data breach

The GDPR speaks of a “personal data breach”: personal data is destroyed, lost, altered, disclosed without authorisation or accessed by someone who should not have access, whether by accident or on purpose. Examples:

• an email with personal data sent to the wrong recipient
• a lost or stolen laptop or phone with customer data
• ransomware that encrypts the server
• an account taken over through phishing

The first hours

1. Note the time when you learned about it. The 72 hours start then.
2. Stop the leak: change passwords, block access, disconnect affected devices, ask the wrong recipient to delete the email.
3. Find out what happened, which data is affected and how many people.
4. Assess the risk for the people concerned: what could happen to them because of it?

Report or not?

If the breach is unlikely to result in a risk to the people concerned, you do not have to report it, but you must document it (Art. 33(5) GDPR). A typical example: an encrypted laptop is lost, and the key was not with it. In all other cases, report it to the data protection authority without undue delay and where feasible within 72 hours (Art. 33 GDPR). In Austria, the Datenschutzbehörde provides a form for this on its website. If not all facts are known yet, report what you know and add the rest later.

When the people concerned must be told

If the risk is high, for example with health data, bank details or passwords, you must also inform the people concerned without undue delay, in plain language: what happened, what you are doing about it and what they can do themselves, such as changing a password (Art. 34 GDPR).

If a service provider is involved

If the breach happens at a processor, such as your IT provider or cloud service, it must inform you without undue delay (Art. 33(2) GDPR). The duty to report to the authority stays with you as the controller. Make sure your data processing agreements regulate this.

Prepared is half done

Print our data breach checklist and agree in advance who decides and who reports. If it happens and you need help, write to us.