GDPR Data Breach Response: Notification and Plan

A personal data breach must be notified to the supervisory authority when it is likely to result in a risk to the rights and freedoms of natural persons. The notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the 72-hour deadline cannot be met, the delay must be explained. No notification is required if the breach is unlikely to pose a risk to individuals — for example, when encrypted data was accessed but could not be decrypted.

The notification must describe the nature of the breach, state the categories and approximate number of affected individuals and data records, provide the data protection officer as a contact point, describe the likely consequences of the breach, and outline the measures taken or proposed to address it. Where it is not possible to provide all information at once, it may be provided in phases without undue further delay.

Affected individuals must be notified when the data breach is likely to result in a high risk to their rights and freedoms. The notification must use clear and plain language, describing the nature of the breach, the contact point, the likely consequences and the measures taken. Notification is not required if appropriate safeguards such as encryption were in place, or if subsequent measures have eliminated the high risk.

Failure to comply with the notification obligation under Article 33 GDPR can result in fines of up to EUR 10 million or 2% of global annual turnover. Additional violations of the individual notification requirement under Article 34 can lead to fines of up to EUR 20 million or 4% of annual turnover. The fine amount depends on the nature and severity of the violation, its duration, the number of affected individuals and the degree of cooperation with the supervisory authority.

A structured incident response process consists of six steps: detection of the incident through technical monitoring or employee reporting, initial assessment to evaluate the notification obligation, containment of the breach through immediate technical and organisational measures, notification to the supervisory authority within 72 hours, communication with affected individuals where there is high risk, and post-incident review including root cause analysis and improvement of protective measures.

Notifiable breaches include sending customer data to the wrong recipients, loss of unencrypted laptops or USB drives containing personal data, ransomware attacks with access to customer databases, misconfigured cloud storage with public access to personal data, and phishing attacks gaining access to email accounts containing personal data. Whether notification is required depends on the risk assessment in each individual case.

Data processors must notify the controller without undue delay after becoming aware of a personal data breach. The notification obligation to the supervisory authority lies with the controller, not the processor. The processing agreement under Article 28 GDPR should include clear provisions on notification deadlines, information obligations and the support the processor must provide during a data breach.