Setting up a data breach process: GDPR notification within 72 hours

When personal data is lost, stolen or accidentally disclosed in your company, a clock starts ticking the moment you become aware of it: the GDPR requires a notification to the competent supervisory authority within 72 hours. Without a prepared process with clear responsibilities, this deadline is hard to meet in practice, because risk assessment, documentation and notification have to come together in a very short time.

In brief: In the event of a personal data breach that poses a risk to the individuals concerned, you must inform the supervisory authority within 72 hours under Art. 33/34 GDPR; where the risk is high, the data subjects must also be notified. Every company that processes personal data is affected – without a prepared process, a fine of up to €10 million or 2% of annual turnover is possible.

Who is affected?

The duty to report data breaches applies in principle to every company that processes personal data – regardless of industry or size. That ranges from the sole trader with a customer database, through the online shop with order data, to the business holding employee data in its HR department. Anyone who uses service providers such as cloud providers or external IT support remains responsible under data protection law and should obtain a contractual assurance from them that they will be informed without delay in an emergency. As soon as a personal data breach occurs and creates a risk for the individuals concerned, Art. 33/34 GDPR applies – regardless of whether the incident was caused by a hacker attack, a lost laptop or an email sent to the wrong recipient. Which obligations apply to your company specifically is shown by a tool such as Company Audit.

What do you need to do in practice?

A process that works in an emergency consists of a few but clearly defined building blocks. Prepare them before an incident occurs – in an emergency there is no time left for it, because the clock runs from the moment anyone in the company learns of the breach:

1. Define the internal reporting channel: who must be informed immediately in the event of a security incident?
2. Prepare a checklist for the risk assessment (which data, how many people affected, what risk).
3. Keep a template ready for the notification to the supervisory authority.
4. Prepare a template for notifying the individuals concerned where the risk is high.
5. Document incidents and reporting decisions – even if in the end no report is made.

Also determine who coordinates the process in an emergency – usually the management together with a data protection officer, if one has been appointed. The more clearly responsibilities are assigned in advance, the less time is lost in the first hours after an incident becomes known.

By when and how often do you have to report?

The deadline is 72 hours from becoming aware of the data breach – and that means 72 calendar hours, not working days. An incident on a Friday afternoon therefore does not give you until Monday; the deadline keeps running over the entire weekend. What matters is the point at which the company has sufficient certainty about the incident – not the completion of a full internal investigation. There is no fixed recurrence as with other obligations: the duty to report arises ad hoc, as soon as a data breach with a risk to the individuals concerned actually occurs. That is exactly why the process must be permanently ready for use and not just thought through once a year.

What are the consequences of a breach?

If the reporting deadline is missed or the report is omitted altogether, fines of up to €10 million or 2% of annual turnover are possible. The amount imposed in an individual case depends on the severity and circumstances of the infringement. Besides the risk of a fine, data breaches that become known without a reliable process also bring a loss of trust among customers and business partners and considerable effort in dealing with enquiries from the authorities. A documented process that can be called up at any time is therefore not just a formality, but the most effective protection against a late or missing report.

Frequently asked questions

What counts as a reportable data breach?

Any personal data breach that poses a risk to the rights and freedoms of the individuals concerned must be reported – for example the loss, theft or unauthorised disclosure of customer or employee data. Whether there is a risk is determined by the risk assessment checklist prepared in advance.

Do I have to report every incident to the supervisory authority?

No, only incidents that pose a risk to the individuals concerned must be reported under Art. 33/34 GDPR. You should, however, also document incidents that need not be reported internally, so that you can prove this if in doubt.

What is the difference between reporting and notification?

The report under Art. 33 GDPR is addressed to the supervisory authority and is due for any risk. The notification under Art. 34 GDPR is addressed additionally to the data subjects themselves and becomes necessary only where there is a high risk.

Do weekends count towards the 72-hour deadline?

Yes. The 72 hours are calendar hours, not working days. The deadline therefore keeps running without interruption on weekends and public holidays – an incident on Friday may thus have to be reported as early as Sunday.

What should I prepare before an incident happens?

Set up in advance an internal reporting channel, a checklist for the risk assessment and templates for the report and the notification, and document every incident – even if it ultimately does not have to be reported. That way you lose no time in an emergency searching for who is responsible or for wording.

Source: Art. 33/34 GDPR. This article is general information and does not replace legal advice in an individual case. As of: July 2026.