What is a personal data breach?
A personal data breach (sometimes called a "data incident") occurs under Art. 4(12) GDPR when personal data is accidentally or unlawfully destroyed, lost, altered, or subject to unauthorized disclosure or access.
Examples: a hacking attack, an email accidentally sent to the wrong recipients, a lost laptop, or faulty cloud access.
The 72-hour notification obligation
Under Art. 33 GDPR, you must notify a personal data breach to the competent supervisory authority within 72 hours of becoming aware of it — provided the breach is likely to result in a risk to the rights and freedoms of the individuals concerned.
The notification must include:
- The nature of the breach and the categories of data affected
- The number of affected individuals and records
- The name and contact details of the DPO
- The likely consequences of the breach
- The remedial measures taken or planned
Notifying affected individuals (Art. 34 GDPR)
If the breach poses a high risk to the affected individuals, you must additionally inform them directly — without undue delay and in clear language.
What we do for you
- Immediate assessment — is this a notifiable breach?
- Evidence preservation — what happened, and which data is affected?
- Notification — drafting and submitting the report to the supervisory authority
- Communication with affected individuals — where required
- Documentation — mandatory internal record-keeping (Art. 33(5) GDPR)
- Follow-up — what needs to change to prevent a recurrence?
Prevention beats reaction
We don't just help you in an emergency — we also help you avoid data breaches in the first place: through clear processes, trained staff, and technical safeguards.