A data breach has occurred, and now the crucial question arises: Does the data breach need to be reported to the data protection supervisory authority?
The short answer is: Not every data breach must be reported. A report pursuant to Article 33(1) of the GDPR is required if a breach of personal data protection is likely to result in a risk to the rights and freedoms of natural persons. If the breach is not likely to result in such a risk, there is no obligation to report it to the supervisory authority.
However, the decision often must be made under considerable time pressure. A reportable data breach must be reported immediately and, if possible, within 72 hours of becoming known.
Not every data protection violation constitutes a reportable data breach
First, we need to distinguish between the different concepts.
Not every violation of the GDPR constitutes a reportable data breach under Article 33 of the GDPR.
Article 33 of the GDPR concerns a personal data breach. Article 4(12) of the GDPR defines a personal data breach as a breach of security that—whether accidental or unlawful—results in the destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data.
Typical examples might include:
- Personal data is sent to the wrong recipient,
- Unauthorized individuals gain access to customer or employee data,
- If a data storage device or laptop containing personal information is lost,
- Personal data is stolen in a cyberattack,
- Data is encrypted by ransomware and is no longer accessible,
- Files containing personal data are inadvertently made publicly available.
Whether such an incident must also be reported to the supervisory authority depends on a risk assessment of the specific case.
Which data breaches must be reported under Article 33 of the GDPR?
For the examination, three categories can be distinguished:
1. No risk anticipated: no report to the regulatory authority
If the personal data breach is not likely to result in a risk to the rights and freedoms of natural persons, it does not need to be reported to the supervisory authority pursuant to Article 33(1) of the GDPR.
However, that does not mean the matter can simply be set aside.
Under Article 33(5) of the GDPR, the controller must document personal data breaches. The documentation must include, in particular, the facts surrounding the breach, its effects, and the corrective measures taken.
That is why a well-reasoned risk assessment is particularly important when deciding not to report an incident.
2. Anticipated Risk: Notification to the Regulatory Authority
If a risk to the rights and freedoms of the data subjects cannot be ruled out and the breach is likely to result in such a risk, it must be reported to the competent data protection supervisory authority pursuant to Article 33(1) of the GDPR.
The report must be filed immediately and, if possible, within 72 hours after the data controller becomes aware of the breach.
If the report is submitted more than 72 hours after the incident occurred, the delay must be justified to the regulatory authority.
We explain more about the reporting deadline and the proper steps to take after a data breach is discovered in our article “72 Hours Go By Fast.”
3. Anticipated high risk: Notify additional affected individuals
If the data breach is likely to result in a high risk to the rights and freedoms of natural persons, an additional obligation applies.
Under Article 34(1) of the GDPR, the controller must, as a general rule, notify the data subjects of the breach without undue delay.
However, Article 34(3) of the GDPR provides for exceptions to this obligation to notify. Therefore, the question of whether data subjects must be informed must be examined separately.
How is the risk of a data breach assessed?
Whether a data breach is subject to reporting requirements cannot generally be determined based solely on the nature of the incident.
The specific circumstances are particularly important for the risk assessment. Among other things, the following must be taken into account:
- Type of data breach,
- The nature and sensitivity of the personal data in question,
- Scope of the affected data,
- Number of people affected,
- The ability to identify the individuals concerned based on the data,
- possible material or immaterial consequences for those affected,
- the particular vulnerability of the individuals concerned,
- existing technical safeguards, such as effective encryption,
- The identity and status of an unauthorized recipient, as well as
- measures already taken to limit potential consequences.
Therefore, what matters is not just what happened from a technical standpoint, but what specific consequences the incident may have for the individuals affected and how likely it is that these consequences will occur.
Sending an email to the wrong recipient does not automatically trigger a reporting requirement
This is evident, for example, when an email is sent to the wrong recipient.
The fact that personal data was inadvertently transmitted to the wrong recipient constitutes, in and of itself, a violation of personal data protection. Whether a report to the supervisory authority is also required, however, depends on the circumstances.
For example, it may be important to know what data was sent, who received it, whether the recipient can be considered trustworthy, whether the recipient was able to delete the message without opening it, and what potential consequences this may have for the individuals involved.
It would therefore be incorrect to make a blanket statement that every incorrect shipment must be reported or that none are ever subject to reporting requirements.
Ransomware must also be evaluated on a case-by-case basis
The same applies in the event of a ransomware attack.
In its guidelines, the European Data Protection Board addresses various ransomware scenarios. The assessment depends, among other things, on whether personal data was merely encrypted or was also leaked, whether appropriate backups are available, which data is affected, and what consequences its unavailability may have.
As a result, even in the case of technically similar attacks, the assessment under data protection law may differ.
The EDSA provides guidance on typical data breaches
The European Data Protection Board has now published the final version of its Guidelines 01/2021 on examples of personal data breach notifications.
Based on specific case scenarios, the guidelines address, in particular, risk assessment and the question of whether
- the incident need only be documented internally,
- a report to the regulatory authority is required, or
- In addition, the affected individuals must be notified.
In addition, Guidelines 9/2022 on the reporting of personal data breaches under the GDPR are relevant for the general assessment of data breaches.
The examples provided by the EDSA can help with classification. However, they do not replace an assessment of the specific data protection incident.
What information must be reported in the event of a reportable data breach?
Article 33(3) of the GDPR specifies the minimum information that the notification must contain.
These include, in particular:
- a description of the nature of the personal data breach and—to the extent possible—information regarding the categories and approximate number of affected individuals and data records,
- Name and contact information of the data protection officer or another point of contact,
- a description of the likely consequences of the data breach, as well as
- A description of the measures taken or proposed to remedy the violation and, where appropriate, to mitigate any potential adverse effects.
If not all information is available within the short notification period, details may be submitted in stages in accordance with the conditions set forth in Article 33(4) of the GDPR. The additional information must then be provided without undue further delay.
What should companies check after a data breach?
In the event of a current data protection incident, the following should be clarified as soon as possible:
- Is there a breach of personal data protection within the meaning of Article 4(12) of the GDPR?
- When was the data breach discovered?
- What personal data is involved, and how many people are affected?
- What are the potential consequences for the individuals involved?
- Is there a risk that requires reporting under Article 33 of the GDPR?
- Is there a high risk, and must the affected individuals therefore be notified in accordance with Article 34 of the GDPR?
- What technical and organizational measures need to be taken immediately?
- How are the incident and the decision made documented?
In particular, distinguishing between no risk, risk, and high risk can be difficult in individual cases. Added to this is the significant time pressure imposed by Article 33 of the GDPR.
Support in the Event of Data Breaches and Data Incidents
We assist companies with the legal assessment of data breaches and in determining whether a data breach must be reported.
In particular, this may involve the
- Legal classification of the data breach,
- Risk Assessment pursuant to Articles 33 and 34 of the GDPR,
- Review of the obligation to report to the data protection supervisory authority,
- Preparation and review of the report,
- Review of a notification to the affected individuals,
- legally compliant documentation of the incident, as well as
- Communication with the Data Protection Supervisory Authority
go.
If your company has recently experienced a data breach, a legal assessment should be conducted promptly due to the potential 72-hour deadline. Please contact us.
Frequently Asked Questions About Reporting Data Breaches
Does every data breach have to be reported to the supervisory authority?
No. Under Article 33(1) of the GDPR, a personal data breach does not need to be reported if it is unlikely to result in a risk to the rights and freedoms of natural persons.
Does a data breach that is not subject to mandatory reporting have to be documented?
Yes. Under Article 33(5) of the GDPR, personal data breaches must be documented. This applies even if, based on the risk assessment, no report is submitted to the supervisory authority.
When must a data breach be reported?
According to Article 33(1) of the GDPR, a reportable data breach must be reported without delay and, if possible, within 72 hours after the controller becomes aware of it.
When must the affected individuals be notified?
If the breach is likely to result in a high risk to the rights and freedoms of natural persons, the affected individuals must, as a general rule, be notified without delay in accordance with Article 34(1) of the GDPR. The exceptions set forth in Article 34(3) of the GDPR must be assessed separately.
What happens if not all the information is available after 72 hours?
Article 33(4) of the GDPR allows for the information required to be provided in stages, subject to the conditions set forth therein. Therefore, an initial notification need not be deferred solely because not all details have yet been clarified.
