Reporting a Data Breach Under GDPR: Step by Step in 72 Hours

How do you report a data breach under the GDPR?

You must report a data breach to the competent data protection supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it as the controller – unless the breach is unlikely to result in a risk to the individuals affected (Art. 33 GDPR). If there is a high risk, you must also inform the affected individuals (Art. 34 GDPR). You must document every data breach, even if it does not need to be reported.

A single wrong click or a cyberattack is all it takes – and suddenly your company is under massive pressure. Acting without structure risks not only reputational damage but also steep fines. This practical guide shows you step by step how to contain a data leak, assess the risk and meet the 72-hour deadline.

What is a data breach under the GDPR?

A data breach (in the legal text: personal data breach) is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Art. 4(12) GDPR).

Typical examples from everyday business include:

• Hacking attacks and ransomware: encryption or exfiltration of customer data by cybercriminals.
• The classic email mistake: accidentally sending spreadsheets containing salary or customer data to the wrong recipient.
• Lost hardware: a company laptop left on the train or a lost, unencrypted USB stick.
• Internal missteps: employees accessing personnel files without a legitimate reason.
• Technical mishaps: misconfigured cloud storage (e.g. on AWS or Azure) that leaves databases exposed on the internet.

Not every data breach has to be reported. What matters is whether the incident creates a risk to the rights and freedoms of the individuals affected.

Reporting obligations under Art. 33 and 34 GDPR – an overview

The legal basis for crisis management in data protection consists of two key provisions:

• Art. 33 GDPR (notifying the authority): Sets out the obligation to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours. The only exception is breaches that are unlikely to result in a risk to the individuals affected.
• Art. 34 GDPR (notifying affected individuals): Describes when you must inform the affected individuals (customers, employees, users) directly. This is required if the breach is likely to result in a high risk, such as a threat of identity theft or financial loss.

Important for when the clock starts: The 72 hours begin as soon as you, as the controller, have a reasonable degree of certainty that a data breach has occurred. A short investigation to establish whether personal data is actually affected is allowed. However, it must not be delayed – and internal reporting channels must be organised so that reports from employees reach those responsible quickly.

Late notification: If you cannot meet the 72 hours, you must still report the breach and give the reasons for the delay (Art. 33(1) GDPR).

Processors: If the breach occurs at a service provider, the provider must inform you without undue delay (Art. 33(2) GDPR). Notifying the authority remains your responsibility as the controller. Set out these obligations in the data processing agreement.

The first hours after discovery: the 5-step process

As soon as a possible data breach is on the table, a structured approach determines whether you face a fine or successfully limit the damage. Proceed in this order:

1. Log the incident immediately: Document the relevant facts (What happened? When was it noticed? Which categories of data are affected?).
2. Alert internally: Inform the responsible people immediately (data protection officer, IT lead, management).
3. Contain the technical damage: Take emergency measures, e.g. disconnect affected servers, lock compromised accounts, secure backups.
4. Carry out an initial risk assessment: IT and data protection jointly assess whether there is a risk to the rights of those affected.
5. Clarify communication and deadlines: Decide on next steps and prepare the notification to the authority.

Assessing the data breach: when must you report it?

The risk assessment is the legal crux. If you wrongly assess the risk as “non-existent” and do not report the breach, you face heavy fines.

For a proper risk assessment, analyse these factors:

• Type and sensitivity of the data: Are we talking about simple addresses or sensitive data such as health data, passwords, credit card details or bank information?
• Extent of potential harm: How likely and how severe are the possible consequences for those affected (e.g. phishing waves, identity theft, reputational damage)?
• Recipients: Is the data with a known, trustworthy third party (e.g. mistakenly emailed to a long-standing partner who confirms deletion) or with cybercriminals?
• Effectiveness of protective measures: Was the data encrypted in line with the state of the art (e.g. AES-256), and is the key secure? If so, there is usually no risk.

Practical tip: The line between a “normal” and a “high” risk is fluid and hard to assess in an emergency without experience. Wrong decisions can lead to fines. To avoid losing time in the 72-hour window, an external data protection officer can help you quickly assess the incident and prepare the notification with you.

Documenting and reporting the data breach

Regardless of whether a data breach ultimately has to be reported: under Art. 33(5) GDPR, you must document every personal data breach internally. If a supervisory authority audits you, you must be able to present this incident register in full.

The documentation must include:

• the facts of the incident and its effects,
• the categories of data affected and the approximate number of individuals affected,
• the remedial measures taken,
• the reasons why the incident was or was not reported.

The notification to the competent supervisory authority – in Germany usually the state data protection authority where the company is based – is generally submitted via its online reporting form.

Communicating with affected individuals: when is notification necessary?

If the risk assessment shows a high risk for those affected, Art. 34 GDPR applies. You must inform the affected individuals without undue delay and in clear, plain language.

The notification must include at least:

• a description of the nature of the personal data breach,
• the name and contact details of the data protection officer or another contact point,
• the likely consequences of the incident,
• the measures you have taken or plan to take to address the breach and mitigate its effects.

It also makes sense to include concrete recommendations: What can affected individuals do to protect themselves (e.g. change passwords, check account statements, stay alert to suspicious calls)?

Notification is not required in exceptional cases: if the data was protected by encryption, if subsequent measures have eliminated the high risk, or if notification would involve disproportionate effort – in which case a public communication takes its place (Art. 34(3) GDPR).

Checklist: reporting a data breach within 72 hours

1. Document the incident, including the time you became aware of it.
2. Inform the data protection officer, IT lead and management.
3. Take immediate measures to limit the damage.
4. Determine the categories of data and the number of individuals affected.
5. Assess the risk: no risk, risk or high risk.
6. If there is a risk: notify the supervisory authority within 72 hours – in phases if necessary.
7. If there is a high risk: inform the affected individuals without undue delay.
8. Check whether additional reporting obligations apply under NIS2 or DORA.
9. Record the decision and its reasons in the incident register.
10. Analyse the causes and implement measures to prevent a recurrence.

Helpful tools, checklists and templates

A structured process protects you from mistakes under time pressure. These tools should be readily available in your data protection handbook:

• Data breach checklist: a clear protocol that is launched at the first suspicion – such as the checklist above.
• Template notification letters: pre-drafted text blocks for communicating with affected individuals, so you don’t waste time on wording in an emergency.
• Internal incident log: a standardised template for fulfilling the documentation obligation.
• Incident response platforms: software-supported workflows that manage the reporting chain within the company.

Preparing through training and processes: how to avoid chaos

In addition to the GDPR, other reporting obligations may apply:

• NIS2: Important and essential entities must report significant security incidents to Germany’s BSI – with an early warning within 24 hours, a notification after 72 hours and a final report after one month.
• DORA: Financial entities report major ICT incidents to BaFin – the initial notification within just 4 hours of classification, and no later than 24 hours after becoming aware. Find out more in our DORA overview.

You can only prevent chaos in an emergency through preparation:

• Regular awareness training: Most data breaches are caused by human error (phishing, misdirected emails). Training is the best prevention.
• Clear reporting channels: All employees must know: who do I contact if I suspect data has been leaked?
• Tabletop exercises: Run through an emergency scenario (e.g. a ransomware attack on a Friday afternoon) with the IT lead, the data protection officer and management.

Conclusion

Reporting a data breach on time is a complex process under time pressure, but one that is very manageable with the right preparation. Closing the security gap, assessing the risk and documenting the incident must go hand in hand. Companies that establish clear responsibilities, prepare checklists and rely on professional support turn a potential crisis into a well-managed process.

With heyData, you are prepared: with an external data protection officer, templates for notifications and incident registers, and training for your team.

Take the first step: Book a free demo now