Blog

One of the most critical aspects of GDPR compliance is knowing how to handle data breaches. The regulation imposes strict notification requirements that catch many organizations off guard. Understanding the rules around breach detection, assessment, and notification is essential for any business that processes personal data of EU residents.

What Qualifies as a Data Breach Under GDPR?

GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. This definition is broader than many organizations expect. A data breach is not limited to cyberattacks or hacking incidents.

Common examples of data breaches include:

• An employee sending personal data to the wrong email recipient
• A lost or stolen laptop containing unencrypted customer records
• A ransomware attack that locks access to patient files
• An unauthorized employee accessing personnel records
• A database misconfiguration exposing user data to the public internet
• Accidental deletion of records without a backup

The key point is that breaches are not always malicious. Accidental incidents count just as much as deliberate attacks under GDPR.

The 72-Hour Notification Rule

Article 33 of GDPR requires data controllers to notify the relevant supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

The 72-hour clock starts ticking from the moment the organization becomes “aware” of the breach — not when it occurred. An organization is considered aware when it has a reasonable degree of certainty that a security incident has compromised personal data.

What the Notification Must Include

The notification to the supervisory authority must contain:

• The nature of the breach, including the categories and approximate number of data subjects and records affected
• The name and contact details of the Data Protection Officer (DPO) or other contact point
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its effects

If you cannot provide all information at once, GDPR allows you to provide it in phases, as long as there is no undue delay.

When to Notify Affected Individuals

Article 34 requires that data subjects be notified when a breach is likely to result in a high risk to their rights and freedoms. This is a higher threshold than notification to the supervisory authority. Not every breach requires individual notification.

You do not need to notify individuals if:

• You had appropriate technical and organizational measures in place (such as encryption) that render the data unintelligible to unauthorized persons
• You have taken subsequent measures that ensure the high risk is no longer likely to materialize
• Individual notification would involve disproportionate effort — in which case, a public communication or similar measure is acceptable

Building a Breach Response Plan

Waiting until a breach occurs to figure out your response is a recipe for failure. Every organization should have a documented breach response plan that covers the following stages:

1. Detection and Identification

Establish monitoring systems and train staff to recognize potential breaches. The faster you detect a breach, the more time you have within the 72-hour window. Many organizations lose precious hours because employees do not know what constitutes a breach or who to report it to internally.

2. Containment

Once a breach is identified, act immediately to contain it. This might mean isolating affected systems, revoking compromised credentials, or blocking unauthorized access points. The goal is to prevent further data loss while preserving evidence for investigation.

3. Assessment

Evaluate the scope and severity of the breach. Determine what data was affected, how many individuals are impacted, and what the potential consequences are. This assessment drives your notification decisions — both to the supervisory authority and to affected individuals.

4. Notification

Based on your assessment, notify the supervisory authority within 72 hours if the breach is likely to result in a risk to individuals’ rights and freedoms. If the risk is high, also notify affected individuals directly and without undue delay.

5. Recovery and Remediation

Restore affected systems and data from backups. Implement additional security measures to prevent similar breaches. Update your security protocols based on lessons learned.

6. Documentation

Article 33(5) requires you to document all breaches, regardless of whether they are reportable. This documentation must include the facts of the breach, its effects, and the remedial action taken. Supervisory authorities may audit these records at any time.

Common Pitfalls in Breach Handling

Organizations frequently make critical errors when responding to breaches:

• Delayed internal escalation — Employees discover issues but do not report them promptly, eating into the 72-hour window before leadership is even aware.
• Over-notifying or under-notifying — Some organizations notify individuals for every minor incident (creating notification fatigue), while others fail to notify when genuinely required.
• Poor record-keeping — Without detailed documentation, you cannot demonstrate compliance to supervisory authorities during an investigation.
• No regular testing — A breach response plan that has never been tested is unlikely to work smoothly under pressure. Conduct tabletop exercises at least annually.
• Ignoring processor obligations — Data processors must notify the controller without undue delay after becoming aware of a breach. Ensure your contracts with processors include clear breach notification clauses.

The Role of Encryption and Pseudonymization

Encryption plays a pivotal role in breach management under GDPR. If breached data was properly encrypted and the encryption keys were not compromised, the breach may not need to be reported to data subjects — because the data is unintelligible to the unauthorized party.

Similarly, pseudonymization — replacing identifying information with artificial identifiers — can reduce the risk to data subjects in the event of a breach. While pseudonymized data is still personal data under GDPR, it is significantly less useful to an attacker without access to the additional information needed to re-identify individuals.

Both encryption and pseudonymization are explicitly mentioned in GDPR as appropriate technical measures. Investing in these technologies is not just good security practice — it directly reduces your regulatory exposure in the event of a breach.

Conclusion

Data breaches are inevitable — what matters is how you prepare for and respond to them. GDPR’s breach notification requirements are demanding but manageable with proper planning. Build a response plan now, train your staff to recognize and report incidents, invest in encryption and access controls, and document everything. The 72-hour clock waits for no one, and the organizations that handle breaches well are those that prepared before the breach occurred.

The General Data Protection Regulation (GDPR) remains the most influential data privacy framework in the world. Since its enforcement in May 2018, it has reshaped how organizations collect, process, and store personal data. Whether you operate within the European Union or handle EU citizens’ data from abroad, GDPR compliance is not optional — it is a legal obligation with serious consequences for non-compliance.

What Is GDPR and Why Does It Matter?

GDPR is a regulation enacted by the European Union to protect the personal data and privacy of individuals within the EU and the European Economic Area (EEA). It applies to any organization — regardless of location — that processes personal data of EU residents.

The regulation matters because it gives individuals unprecedented control over their personal data. It establishes clear rights for data subjects and strict obligations for data controllers and processors. Failing to comply can result in fines of up to 20 million euros or 4% of annual global turnover, whichever is higher.

The 7 Core Principles of GDPR

GDPR is built on seven fundamental principles that guide all data processing activities:

1. Lawfulness, fairness, and transparency — Data must be processed legally, fairly, and in a transparent manner.
2. Purpose limitation — Data must be collected for specified, explicit, and legitimate purposes only.
3. Data minimization — Only data that is necessary for the stated purpose should be collected.
4. Accuracy — Personal data must be kept accurate and up to date.
5. Storage limitation — Data should not be kept longer than necessary.
6. Integrity and confidentiality — Data must be processed securely, protecting against unauthorized access, loss, or destruction.
7. Accountability — The data controller must demonstrate compliance with all principles.

Key Rights of Data Subjects

GDPR grants individuals several important rights regarding their personal data:

• Right of access — Individuals can request a copy of the data held about them.
• Right to rectification — Individuals can request correction of inaccurate data.
• Right to erasure (right to be forgotten) — Individuals can request deletion of their data under certain conditions.
• Right to data portability — Individuals can request their data in a machine-readable format to transfer to another controller.
• Right to object — Individuals can object to processing based on legitimate interests or direct marketing.
• Right to restrict processing — Individuals can request that processing be limited in certain circumstances.

Steps to Achieve GDPR Compliance

Achieving compliance requires a structured approach. Here are the essential steps every organization should follow:

1. Conduct a Data Audit

Map all personal data your organization collects, stores, and processes. Identify where it comes from, where it goes, and who has access to it. This data inventory is the foundation of your compliance program.

2. Establish a Legal Basis for Processing

Every data processing activity must have a valid legal basis under Article 6 of GDPR. The six lawful bases are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Document which basis applies to each processing activity.

3. Update Your Privacy Policy

Your privacy policy must clearly explain what data you collect, why you collect it, how you use it, how long you keep it, and what rights individuals have. It must be written in plain, accessible language — not legal jargon.

4. Implement Consent Mechanisms

Where consent is your legal basis, it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes are not valid. You must be able to demonstrate that consent was obtained and provide an easy way to withdraw it.

5. Appoint a Data Protection Officer (DPO)

A DPO is mandatory for public authorities and organizations that carry out large-scale systematic monitoring or process special categories of data. Even when not required, appointing a DPO is considered best practice.

6. Prepare for Data Breaches

Under GDPR, you must report certain types of data breaches to the relevant supervisory authority within 72 hours of becoming aware of them. If the breach poses a high risk to individuals, you must also notify the affected data subjects. Have an incident response plan ready.

Common GDPR Compliance Mistakes

Many organizations struggle with compliance because they fall into common traps:

• Treating compliance as a one-time project — GDPR compliance is ongoing. Regular audits and updates are essential.
• Ignoring third-party processors — You are responsible for ensuring your vendors and partners also comply with GDPR.
• Collecting more data than needed — Data minimization is a core principle. Only collect what you genuinely need.
• Using vague or buried privacy notices — Transparency requires clear, accessible communication about data practices.
• Failing to document processing activities — Article 30 requires maintaining records of processing activities. Documentation is critical for demonstrating accountability.

The Cost of Non-Compliance

GDPR enforcement has intensified significantly. Since 2018, supervisory authorities across Europe have issued billions of euros in fines. Major penalties have been levied against tech giants and small businesses alike. Beyond financial penalties, non-compliance damages reputation, erodes customer trust, and can lead to costly litigation.

The regulation distinguishes between two tiers of fines: up to 10 million euros (or 2% of global turnover) for less severe infringements, and up to 20 million euros (or 4% of global turnover) for more serious violations such as breaching core principles or data subject rights.

Conclusion

GDPR compliance is not just about avoiding fines — it is about building trust with your customers and demonstrating that you take their privacy seriously. By understanding the core principles, respecting data subject rights, and implementing robust data protection practices, your organization can turn compliance into a competitive advantage. Start with a data audit, establish your legal bases, and build a culture of privacy that permeates every level of your organization.