A data breach happened: what you must do within 72 hours

When do the 72 hours start?

This is where the most common misreading happens. The period starts when the controller **learns** of the breach, not when the breach occurred. For a leak that happened months ago but was noticed today, the 72 hours run from today.

The practical consequence: an organisation without detection capability cannot notify on time — because the moment of learning either never arrives or arrives far too late. And that is precisely one of the questions asked in an audit: how and when did you notice the breach?

Which incidents count as a data breach?

Personal data being obtained unlawfully by others is a breach. That definition is wider than assumed: not only an external attack but an email sent to the wrong recipient, a lost unencrypted laptop, an unauthorised employee downloading a customer list, and backups left in open storage all fall within it.

In some cases — the loss of an encrypted device, for instance — it can be argued the risk did not materialise; but that assessment has to be made and recorded at the time of the incident. Saying afterwards "it was not risky anyway" is not a defence without the record.

What if our supplier discovers the breach?

When your cloud provider, software supplier or call centre notices a breach, they are obliged to notify you without delay. The clock still starts with your awareness, but a delay in that chain does not save you: what an audit asks is whether such a notification duty was in writing between you and the supplier.

That is why processor contracts carry a one-sentence clause: the party becoming aware of a breach notifies the other in writing without delay and in any case within twenty-four hours of becoming aware. Without that clause your 72 hours are effectively at your supplier's mercy.

Can you notify while information is still missing?

Notification can be made in stages. Where all the information cannot be provided at once, notification is made with what is available and the rest is submitted as it is completed. This is not an exception but the intended route — read the 72 hours as time allowed to make the first notification rather than to finish the investigation.

Where the deadline could not be met at all for a justified reason, the reasons for the delay are explained together with the notification. An unexplained delay is treated more severely than the delay itself.

How do you tell customers about a data breach?

Notifying the authority and notifying affected individuals are two distinct obligations, and the second is skipped in most companies. The purpose of both is the same: letting people protect themselves. So the text should read like a warning rather than a legal document — which data was affected, what risk it creates, and what the person should do, stated plainly.

Where no contact address is known, notification can be made by an appropriate method such as an announcement published on the company's own website. The measure of appropriateness is whether the notice has a real chance of arriving; a link in the site's footer does not meet it.

How do you prepare a breach response plan?

• A breach response plan: who decides, who notifies, who handles communication — named in writing.
• Detection: access logs, unusual-download alerts, and regular scanning of backup and storage permissions.
• A notification clause and deadline in processor contracts.
• An inventory: which data sits in which system — the only way to establish scope within 72 hours.
• Draft notifications: an internal template for the authority's form and a draft of the text going to individuals.

What is the penalty for a data breach?

Amounts are revalued each year, so no figure is printed here — confirm the amount in force on the authority's page. What matters more is what the penalty is calculated against: not the breach itself but the adequacy of the measures taken and whether notification was timely. Timely notification and documented measures read in your favour; concealment reads against you.

If an employee leaked the data, is notification still needed?

Yes. Whether the source is internal or external does not change the obligation; the test is personal data being obtained unlawfully by others. In that scenario employment law runs in parallel, but that is a separate process and not a reason to delay the 72-hour notification.

Is notification needed if the leaked data was encrypted?

If you can show the encryption genuinely protected it, the assessment differs: with the key not leaked and a current method in use, it can be argued the risk did not materialise. But that assessment has to be made and recorded at the time. An after-the-fact "it was encrypted anyway" is not accepted in an audit without the contemporaneous record.

How many people have to be affected before notifying?

The number of people is not a threshold. The obligation arises even where one person's data was affected; the count only affects the severity and how individuals are notified. "Few people were affected, let us not report it" is the most common mistake read as concealment in an audit.

“The 72 hours are time allowed to make the first notification, not to finish the investigation.”