Why You Shouldn't Wait Until Just Before the Deadline in the Event of a Data Breach
“We have a data breach. The 72-hour period expires today. Do we have to report this?” We receive inquiries like this quite often. In such cases, there’s often not enough time to clarify the facts and reliably assess whether reporting is required. That’s because, before the reporting requirement can be assessed, it must first be determined exactly what happened. That takes time—time that’s in short supply as the deadline approaches.
A data breach can happen faster than you think
It doesn't always have to be a major cyberattack. A personal data breach also occurs when, as a result of a security incident, personal data is accidentally lost, destroyed, or altered, or becomes accessible to unauthorized persons (Art. 4(12) of the GDPR).
Examples of potential data breaches in everyday business operations:
- An email containing pay stubs or a customer list with personal information attached is sent to the wrong person.
- An unencrypted USB flash drive containing employee data is lost.
- Job applications are accidentally forwarded to an unauthorized recipient.
Even a single misdirected email can therefore constitute a data breach. Whether it must be reported to the supervisory authority is another matter. That depends on the specific circumstances of each case.
When do the 72 hours start?
Pursuant to Article 33(1), first sentence, of the GDPR, data breaches subject to reporting requirements must be reported to the competent data protection supervisory authority without delay and, if possible, within 72 hours of becoming known.
The key factor is when the responsible company has reasonable certainty that a personal data breach has occurred. The time limit does not begin only when the company contacts a consultant or completes a full investigation. A mere suspicion does not automatically trigger the time limit; however, it must be clarified promptly. The 72 hours are therefore not a waiting period that may generally be fully utilized.
Not every data breach must be reported. A breach does not need to be reported if it is unlikely to pose a risk to the rights and freedoms of the data subjects. This requires a thorough assessment: What data is affected? Who received it? What adverse effects could result? Even data breaches that are not subject to mandatory reporting must be documented. If the risk is likely to be high, the data subjects must generally be notified immediately.
In short: Not every data breach must be reported, but every data breach must be investigated and, at the very least, documented.
For more information on the reporting requirement and risk assessment, see our article“Which Data Breaches Must Be Reported?”
Shortly before the deadline, often the only option is a preliminary assessment
Those who wait until just before the 72-hour deadline to seek advice create unnecessary time pressure. Often, crucial information is then missing. It is not always possible to make a reliable assessment of whether a report is required within just a few minutes.
If there are still doubts regarding the risk assessment, it may be advisable to file a precautionary report. In such a report, the facts known to date and the preliminary risk assessment are communicated, and any unresolved issues are identified.
If the obligation to report has already been established, the report must not be delayed solely because certain details are still missing. To the extent that information cannot yet be provided at the same time, it may be submitted later without undue further delay, in accordance with Article 33(4) of the GDPR. However, this is no substitute for a prompt investigation and legal review.
That's why: Consult early on—as soon as you suspect a problem
Our recommendation is: Contact your data protection advisor as soon as you discover a data breach or suspect one may have occurred. Also involve your data protection officer, if one has been appointed. You do not need to have determined all the details in advance or decided on your own whether there is an obligation to report the incident.
For the initial conversation, just the basic details will suffice: What happened? When was the incident discovered? What data and individuals might be affected? What measures have already been taken?
Seeking advice early on does not mean reporting every suspicion immediately to the data protection authority. Rather, it lays the groundwork for making a timely and well-informed decision about whether to file a report.
So don't wait until the deadline is almost up to report it. Report it as soon as you notice the incident. After all, 72 hours go by quickly.
