Data breach: what to do in the first 72 hours (Articles 33 and 34 GDPR)

A lost laptop with client files, an e-mail sent to the wrong recipient, a ransomware attack or a compromised supplier account: all of these are personal data breaches if they affect the confidentiality, integrity or availability of that data (Art. 4(12) GDPR). What separates a manageable incident from a penalty is how you react in the first few hours.

The deadline: 72 hours from becoming aware

Article 33 requires the controller to notify the breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it. In Spain the authority is the Spanish Data Protection Agency (AEPD), which provides an electronic form for this purpose. If the notification is made later, it must be accompanied by the reasons for the delay.

The only exception is where the breach is unlikely to result in a risk to the rights and freedoms of individuals. That conclusion has to be justified and recorded in writing.

An hour-by-hour action plan

1. Contain the incident. Isolate the affected systems, revoke compromised credentials, cut access and preserve evidence (logs, copies of the systems) without altering it.
2. Alert people internally. Activate whoever needs to be involved: management, IT security lead, the data protection officer if you have one, and legal counsel.
3. Gather the facts. What happened, when it was detected, which systems and categories of data are involved, and how many people may be affected (a rough estimate is enough at first).
4. Assess the risk. Weigh how serious the possible consequences are for the people concerned: identity theft, financial or reputational harm, exposure of special-category data…
5. Decide and document. If there is a risk, notify the authority. If there is not, record the reasoning.
6. Notify the people affected where required (see below).
7. Fix and learn. Close the root cause, review your Article 32 measures and update your record of processing activities and procedures.

What the notification to the authority must include (Art. 33(3))

• The nature of the breach, with the categories and approximate number of data subjects and records concerned.
• The name and contact details of the data protection officer or another contact point.
• The likely consequences of the breach.
• The measures taken or proposed to address it and mitigate its effects.

If you do not have all the information within the deadline, Article 33(4) allows you to provide it in phases without further undue delay. An incomplete initial notification is better than a complete one that is late.

When you must also inform the people affected (Art. 34)

Where the breach is likely to result in a high risk to their rights and freedoms, you must tell them without undue delay, in clear and plain language, explaining what happened, what the consequences may be and what they can do to protect themselves. It is not required if:

• the data was encrypted or protected so that it is unintelligible to anyone who gained access;
• you have taken subsequent measures that ensure the high risk is no longer likely to materialise; or
• it would involve disproportionate effort, in which case a public communication or similar measure is used instead.

If you are a processor

The processor must notify the controller without undue delay after becoming aware of a breach (Art. 33(2)). Check that your Article 28 contracts set specific deadlines and channels: the controller’s 72 hours run from when it becomes aware, and every hour the provider takes to alert you is an hour lost.

Document every breach, including minor ones

Article 33(5) requires you to document any breach: the facts, its effects and the remedial action taken, so that the authority can verify it. A well-kept incident log is one of the strongest pieces of evidence of diligence.

Prepare before it happens

• Write a response protocol with owners, contacts and notification templates.
• Define how an incident is detected and escalated: every employee should know whom to tell and how quickly.
• Run simple drills at least once a year.
• Keep isolated backups, access control and encryption on laptops.
• Keep your legal and contact documents up to date. A centralised manager such as LegalCloud helps your privacy policy and texts always reflect the current procedure.

Read Articles 33 and 34 on EUR-Lex, the European Data Protection Board’s guidelines on breach notification at edpb.europa.eu and practical information from the AEPD. This content is for information only and is not legal advice.