Data Breaches: the 72-Hour Rule

The legal framework

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12) GDPR). It covers confidentiality breaches (data sent to the wrong person, a hacked account), integrity breaches (data altered) and availability breaches (ransomware, deleted data without a usable backup).

Notification to the authority

Article 33(1) requires the controller to notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Which authority that is depends on the country: for processing in one member state it is that country's data protection authority, and for cross-border processing it is normally the lead supervisory authority. If notification is later than 72 hours, the reasons for the delay must accompany it.

The 72 hours run from awareness, not from the breach. The European Data Protection Board considers a controller aware when it has a reasonable degree of certainty that a security incident has led to personal data being compromised. The period includes weekends and holidays.

The notification must describe (Article 33(3)): the nature of the breach, with the categories and approximate number of individuals and records; the contact point; the likely consequences; and the measures taken or proposed. Where all information is not available, it can be provided in phases without further undue delay (Article 33(4)).

Processors

A processor must notify the controller without undue delay after becoming aware of a breach (Article 33(2)). The 72 hours of the controller run from its own awareness, and the EDPB recommends that the processing agreement fix a short and concrete period for the processor's notice. This is why the processor's duty belongs in your data processing agreement.

Communication to individuals

Where the breach is likely to result in a high risk, the controller must also inform the individuals without undue delay, in clear and plain language (Article 34). It is not required if:

• appropriate protection measures were applied to the data, such as encryption that makes it unintelligible to anyone not authorised to access it;
• subsequent measures ensure that the high risk is no longer likely to materialise;
• it would involve disproportionate effort, in which case a public communication or similar measure is used.

The authority can require you to notify individuals if it disagrees with your assessment.

Documentation

Every breach must be documented, whether or not it is notified: the facts, effects and remedial action (Article 33(5)). The authority can verify compliance from this record.

Consequences

A failure to notify, or to document, can be fined under Article 83(4)(a) up to EUR 10 million or 2% of worldwide annual turnover. Individuals may claim compensation for damage under Article 82. Breaches in some sectors also trigger separate duties, for instance under NIS2.

In practice

A small accounting firm discovers on a Friday afternoon that an employee has sent the annual payroll file of a client, with national ID numbers and salaries of 85 people, to the wrong external address. The employee informs the manager at 16:00. That is the moment of awareness. The 72 hours expire on Monday at 16:00.

The firm asks the recipient to delete the file and to confirm in writing. It assesses the risk: salary data and national ID numbers of employees could enable identity fraud, and the recipient is an unrelated company whose conduct is unknown, so a risk is likely. Because the recipient confirmed deletion within hours and is bound by the confidentiality of the contact, the firm judges that the risk is not high, so it notifies the authority but does not inform each employee. The firm records its reasoning. If the recipient had been unreachable, the decision on high risk and on informing individuals would have been different.

The controller of the payroll data is the client, not the firm. As a processor, the firm informs the client at once, which then does the assessment and the notification itself.

Preparation

What makes 72 hours manageable is preparation: a clear internal reporting line, a named decision-maker, a ready-made notification form, a log and a contact at your lawyer. Our breach workflow counts the hours, structures the assessment and keeps the file.

Frequently asked questions

Do weekends count?

Yes. The 72 hours are calendar hours.

What if we do not have all the facts at 72 hours?

Notify with what you have and say that further information will follow (Article 33(4)). Waiting for complete information is a common mistake.

Do we have to notify a breach in which only a few emails were affected?

If the breach is unlikely to result in a risk, notification is not required, but you must document it internally. Whether a risk exists depends on the data and the people.

Must we also tell the people affected?

Only if the risk is high, unless an exception applies. Individuals who ask afterwards what data was involved will use their access rights, which you handle as a data subject request.

How this connects

Our data breach response service covers assessment, notification and any action against the source. Cybersecurity duties that run alongside are covered in The NIS2 Directive.