A Data Breach at Your Business: What the 72-Hour GDPR Rule Really Means

When does the clock start?

The 72 hours run from when you become aware of the breach, which regulators generally take to mean you have a reasonable degree of certainty that a security incident has compromised personal data. Weekends and bank holidays count. If you cannot give the full picture in time, you can notify in phases, but you cannot wait until you know everything.

Do you always have to report it?

No. A breach must be notified to the DPC unless it is unlikely to result in a risk to people, for example where the data was strongly encrypted and the key is safe. But you must record every breach internally, including the facts, the effects, what you did and why you decided as you did on notification.

When must you also tell the individuals?

When the breach is likely to result in a high risk to them, such as exposed financial details, ID numbers, health information, children’s data or a very large number of people. You must tell them without undue delay, in clear language, with advice on what to do to protect themselves.

If you are a processor

If you handle data on behalf of a customer, your duty is to tell that customer without undue delay once you are aware. They then decide on notifying the DPC, and their 72-hour clock may already be running, so speed matters.

The first hour

1. Contain it: change passwords, isolate affected systems and keep evidence rather than wiping anything.
2. Call your IT provider, and your cyber insurer helpline if you have one, since delay can affect cover.
3. Write down what you know and the time you became aware.
4. Decide on notification. Our GDPR breach helper shows your deadline and gives you a printable log.
5. Report notifiable breaches through the Data Protection Commission online breach form.

This is general information, not legal advice. For anything serious, speak to a solicitor or data protection adviser.