Data Breach? Here Is Exactly What to Do in the Next 72 Hours

The Clock Starts the Moment You Become Aware

Under GDPR Article 33, when a personal data breach occurs, the controller must notify the competent supervisory authority within 72 hours of becoming aware of it — unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

That 72-hour window is not when the breach is confirmed. It is not when the full investigation is complete. It starts when you have reasonable certainty that a breach has likely occurred.

Missing the deadline is a separate GDPR violation, carrying fines of up to €10 million or 2% of global annual turnover — in addition to any fines for the breach itself.

The businesses that handle breaches well are not the ones that are luckiest. They are the ones that have a plan written down before anything goes wrong.

What Counts as a Personal Data Breach?

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

This includes:

It does not automatically include every security incident. If an unauthorised person attempts to access data but fails, or if data is encrypted and the key is not compromised, a notifiable breach may not have occurred — but you must still assess and document the incident.

Three Types of Breach — Different Responses

Confidentiality breach: Unauthorised or accidental disclosure of personal data (e.g. email sent to wrong recipient, database accessed by unauthorised party)

Integrity breach: Unauthorised or accidental alteration of personal data (e.g. data modified by an attacker, records corrupted)

Availability breach: Accidental or unauthorised loss of access to or destruction of personal data (e.g. ransomware encrypting data, accidental deletion, server failure with no backup)

Each type requires the same initial assessment: what data was affected, how many people, and what is the likely risk to those individuals?

The 72-Hour Response Plan

Hour 0-4: Contain and Assess

Immediate containment:

Initial assessment — answer these questions:

Hour 4-24: Notify Internally and Begin Documentation

Internal notification:

Breach log entry must include:

This documentation is mandatory. Regulators will ask for it.

Hour 24-48: Decide Whether Notification Is Required

Do you need to notify your supervisory authority?

Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Apply this risk test:

Notification is likely required if:

Notification may not be required if:

When in doubt, notify. Regulators consistently take a less severe view of organisations that over-notify than those that underestimate risk and fail to notify.

Which supervisory authority do you notify?

Hour 48-72: Submit the Notification

What the notification must contain (Article 33(3)):

If you do not have all information available within 72 hours — which is common in complex breaches — submit what you have and follow up. Article 33(4) explicitly permits phased notification where complete information is not available in time. Submitting an incomplete notification on time is far better than a complete notification submitted late.

Do You Also Need to Notify Affected Individuals?

Under GDPR Article 34, you must also notify affected individuals without undue delay (no specific timeframe, but typically within days) if the breach is likely to result in a high risk to their rights and freedoms.

High-risk indicators:

The notification to individuals must:

What You Are NOT Required to Notify Individuals About

You do not need to notify individuals if:

After the 72 Hours: The Longer Response

Once the immediate notification is handled, focus on:

Root cause analysis — what caused the breach and how can it be prevented?

Remediation — patching vulnerabilities, updating access controls, improving encryption, staff training

Policy review — does the breach reveal gaps in your data protection policies, incident response procedures, or vendor management?

Regulatory liaison — the supervisory authority may request further information, an audit, or corrective measures. Cooperate fully and promptly.

Legal review — assess potential civil liability to affected individuals under GDPR Article 82, which gives data subjects the right to compensation for material and non-material damage caused by a breach

The One Thing That Makes Everything Easier

Every organisation that handles a breach well has one thing in common: they had a written Incident Response Plan before the breach happened.

An IRP defines:

Creating this plan after a breach has already started is like writing a fire escape plan during a fire.

Need a GDPR Incident Response Plan or Data Breach Notification Procedure? Our legal team provides ready-to-use breach response documentation customised to your organisation — delivered in 48 hours.