GDPR Breach Response Guide

The clock starts the moment you become "aware." You have 72 hours. This guide helps you assess risk, decide if you need to notify, and provides the templates to do it.

✅ Article 33 & 34 Compliant ✅ Risk Assessment Tool ✅ Notification Templates
Start 72-Hour Checklist Assess Risk Level
⏱️

The Golden Rule: 72 Hours

You must notify your Data Protection Authority (DPA) within 72 hours of becoming aware of the breach, unless it is "unlikely to result in a risk to the rights and freedoms of natural persons." If you miss the deadline, you must provide a valid justification.

The 72-Hour Countdown Checklist

Don't panic. Follow this timeline to ensure you meet your Article 33 obligations.

1
Hour 0-24: Triage & Containment
  • Confirm it is actually a personal data breach.
  • Activate the Incident Response Team.
  • Isolate affected systems to stop the leak.
  • Start a "Breach Log" to document every decision (crucial for defensibility).
2
Hour 24-48: Assessment
  • Determine scope: What data? How many people?
  • Perform Risk Assessment (see tool below).
  • Consult Legal/DPO: Is notification required?
  • Draft notification to DPA if risk is found.
3
Hour 48-72: Notification
  • Submit notification to DPA (Supervisory Authority).
  • Prepare communication for affected individuals (if High Risk).
  • Update Breach Log with submission receipt.

Risk Assessment Tool

Not every breach needs to be reported. Use this matrix to determine your obligation.

Low Risk

Unlikely to harm individuals.

  • ✅ Data is encrypted & key is safe
  • ✅ Internal email sent to wrong colleague (and deleted)
  • ✅ Lost device is remotely wiped immediately
Action:
Document in internal log.
No notification needed.

Risk

Possible harm to individuals.

  • ⚠️ Unencrypted email with customer list
  • ⚠️ Ransomware (with no exfiltration)
  • ⚠️ Accidental publication of non-sensitive data
Action:
Notify DPA (Regulator).
No individual notice.

High Risk

Probable severe harm.

  • 🚨 Health data / Financial data leaked
  • 🚨 Passwords leaked in cleartext
  • 🚨 Identity theft highly likely
Action:
Notify DPA (Regulator).
Notify Individuals ASAP.

Who is my Lead Supervisory Authority?

Under the "One-Stop-Shop" mechanism, you generally report to the DPA where your "main establishment" (HQ) is located in the EU.

🇫🇷 France (CNIL) 🇩🇪 Germany (BfDI) 🇮🇪 Ireland (DPC) 🇬🇧 UK (ICO)*

*UK is post-Brexit but follows UK GDPR (very similar).

Need a DPO or Legal Counsel?

GDPR is complex. If you are unsure about your risk level, consult a privacy lawyer immediately. The fines for getting this wrong are massive.

Find Privacy Counsel View All Notifications

Related Resources

📋
Notification Rules
50-state breach notification matrix
 📄
Policy Template
GDPR-compliant response policy