Data Breach Notification

A personal data breach is a security failure that affects personal data. Article 4(12) of the GDPR defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

The definition is wider than a cyberattack. An email with a client's passport copy sent to the wrong address is an unauthorised disclosure. A laptop left on a train can be a loss. Client files locked by ransomware with no usable backup are lost or destroyed, even if nobody copied them.

Not every breach has to be reported. Every breach has to be assessed.

The controller must notify the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach (Article 33(1) of the GDPR). The one exception is a breach that is unlikely to result in a risk to the rights and freedoms of natural persons.

The period is counted in hours, and Article 33 makes no allowance for weekends or holidays. A notification made later than 72 hours must come with the reasons for the delay. A firm without the full picture can still notify in time. Information that is not yet available "may be provided in phases without undue further delay" (Article 33(4)).

Article 33(3) sets four items as the minimum. The notification describes the nature of the breach, including where possible the categories and approximate number of people and of records concerned. It gives the name and contact details of the data protection officer or another contact point. It describes the likely consequences. It describes the measures taken or proposed to address the breach and to limit its effects.

A separate duty applies to every breach, reported or not. Under Article 33(5) the controller must document any personal data breach: the facts, its effects and the remedial action taken. That documentation must enable the supervisory authority to verify compliance with Article 33, so a firm that decides not to notify should keep its reasons with it.

The controller must tell the people concerned without undue delay when the breach is likely to result in a high risk to their rights and freedoms (Article 34(1)). The threshold is higher than for the authority. Risk triggers the report to the authority. High risk triggers the message to individuals.

The message must describe the nature of the breach in clear and plain language. It must also give the contact point, the likely consequences and the measures taken (Article 34(2)).

Article 34(3) lists three cases in which the message is not required. The first is where the affected data was protected by measures that make it unintelligible to anyone not authorised to access it, such as encryption. The second is where the controller has since taken measures so that the high risk is no longer likely to materialise. The third is where contacting each person would involve disproportionate effort; a public communication must then be made in its place. The supervisory authority can still require the controller to inform people (Article 34(4)).

A processor must notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)). The processor reports to its customer. The customer, as controller, reports to the authority and to individuals. A firm that keeps client files with a cloud provider is the controller in that relationship.

The GDPR sets no number of hours for the processor. The contract between the two must require the processor to assist the controller with its duties under Articles 32 to 36, which include breach notification (Article 28(3)(f)). A firm can use that contract to fix a deadline in hours and to list the details the provider must hand over.

The NIS2 Directive, DORA and the eIDAS Regulation do. The GDPR duty covers personal data. The other three cover security incidents at the entity, whether or not personal data is involved. The table shows who notifies whom under each rule, and by when.

The NIS2 Directive is implemented through national law, so the procedure depends on the member state. It covers significant incidents, as defined in Article 23(3). Qualified trust service providers count as essential entities whatever their size (Article 3(1)(b)). DORA covers major ICT-related incidents at financial entities. Articles 19a and 24(2) of the eIDAS Regulation cover breaches with a significant impact on a trust service or on the personal data it holds. Qualified trust service providers have the same duty, within 24 hours of the incident, under Article 24(2)(fb).

None of these replaces the GDPR notification. One incident at a provider can mean several reports to several authorities, each on its own clock.