Personal Data Breach
Breach of the protection of personal data — 72-hour notification duty
TL;DR
A personal data breach (data breach) within the meaning of Art. 4(12) GDPR is a breach of security leading to the destruction, loss or alteration of personal data, or to the unauthorised disclosure of or unauthorised access to such data. Where a risk is likely: notification to the supervisory authority within 72 hours (Art. 33). Where a high risk is likely: the data subjects must also be informed (Art. 34).
What is a personal data breach?
Three categories of personal data breach:
- Confidentiality: unauthorised access (hacking, phishing, theft)
- Integrity: unauthorised alteration (manipulated data, ransomware)
- Availability: loss, destruction (server crash without a backup, destroyed files)
Practical example
Practical examples:
- Phishing incident with compromised employee credentials → confidentiality
- Email sent to the wrong recipient containing personal data → confidentiality
- Ransomware attack with encrypted databases → availability and integrity
- Loss of an unencrypted laptop → confidentiality
Frequently asked questions
Does the 72-hour deadline also run at night and at weekends?
Yes. The deadline starts on becoming aware of the breach (not from the incident itself). Organisational consequence: the DPO and IT security should be reachable at night and at weekends too — a practice recommendation, not a separate statutory obligation.
What if I only have clarity after 72 hours?
Notify anyway, with the state of knowledge available — Art. 33(4) allows notification in phases.
Do I always have to inform the data subjects?
Only where a high risk is likely (Art. 34). Otherwise notification to the supervisory authority plus internal documentation is sufficient.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.