TOOLBOX · DOWNLOAD
72 hourstonotify.
A misaddressed email, a stolen laptop or an attack on the server: if personal data is affected, a 72-hour deadline starts as soon as you become aware. This checklist guides you through the steps under Art. 33 and 34 GDPR: establish whether a breach has occurred, assess the risk to the data subjects, notify the Data Protection Authority, inform the data subjects and document every breach. It is based on Guidelines 9/2022 and 01/2021 of the European Data Protection Board and the guidance of the Data Protection Authority.
Free PDF · Checklist
Data Breach Under the GDPR: Checklist for the First 72 Hours
- Topic
- NIS2 & Compliance
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 108 KB
- Updated
- Oct 25, 2026
- Sources
- 8
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Establish, assess the risk, notify the Data Protection Authority, inform data subjects and document, under Art. 33 and 34 GDPR and the EDPB guidelines.
- Controllers under the GDPR: management of small and medium-sized businesses
- Data protection officers and data protection coordinators
- IT management that detects and handles security incidents
- Processors that must report breaches to their controllers
8 SECTIONS
What Is
Inside.
- 01
What a data breach is
Definition, the three types and when the deadline starts
- 02
The first 72 hours at a glance
From the first indication to notification and communication
- 03
Assessing the risk
EDPB criteria and the three possible outcomes
- 04
Examples from the EDPB guidelines
How the EDPB assesses typical cases
- 05
Notifying the Data Protection Authority
Contents, notification channels in Austria and notification in phases
- 06
Informing data subjects
When, with what content and which exceptions apply
- 07
Document every data breach
Register of breaches, even if no notification is made
- 08
Interaction with NIS2, the police and the reform
Other reporting channels and what could change
EXCERPT
Assessing the risk
You must assess the likelihood and severity of possible consequences for the data subjects, not for the business. Unlike a data protection impact assessment, this concerns an event that has already occurred. The EDPB recommends considering these criteria (Guidelines 9/2022, Section IV):
- Type of breach: disclosure of health data has a different impact than its loss.
- Nature, sensitivity and volume of the data: health, identity and financial data, combinations of data, even seemingly harmless data with revealing content.
- How easily individuals can be identified; appropriately encrypted data is unintelligible to unauthorized persons without the key.
- Severity and duration of the consequences: identity theft, fraud, physical harm, psychological distress, reputational damage; whether the data is with trusted or unknown recipients.
- Special characteristics of the data subjects, such as children or other vulnerable individuals, and of the controller, such as a medical institution.
- Number of affected individuals.
| Outcome | What to do | Reference |
|---|---|---|
| Unlikely to result in a risk | Document internally only; reassess the risk if the situation changes. | Art. 33(1) and (5) GDPR |
| Risk | Also notify the Data Protection Authority, without undue delay and, where feasible, within 72 hours. | Art. 33(1) GDPR |
| Likely to result in a high risk | Also inform the data subjects without undue delay, unless an exception applies. | Art. 34(1) and (3) GDPR |
When in doubt, the EDPB advises erring on the side of caution and notifying (Guidelines 9/2022, para. 119).
SOURCES
Supported
by Sources.
- Regulation (EU) 2016/679 (GDPR), German version on EUR-Lex (opens in a new tab)Art. 4(12), Art. 33, 34 and 83(4), accessed October 25, 2026
- EDPB: Guidelines 9/2022 on personal data breach notification, version 2.0 (March 28, 2023) (opens in a new tab)Types, awareness, content, risk, documentation; paras. 34, 69, 87, 119; accessed October 25, 2026
- EDPB: Guidelines 01/2021, examples regarding notification, version 2.0 (December 14, 2021) (opens in a new tab)Cases 1, 3, 4, 9, 10 and 11, accessed October 25, 2026
- EDPB: Guidelines at a glance, Data breaches (opens in a new tab)Register of all breaches, reporting cybercrime, accessed October 25, 2026
- Austrian Data Protection Authority: Data breach notification (opens in a new tab)Notification channels, procedure, notification in phases, accessed October 25, 2026
- NISG 2026, BGBl. I No. 94/2025, version in force in the RIS (opens in a new tab)§ 21 cooperation with the Data Protection Authority, § 34 reporting obligations, accessed October 25, 2026
- European Commission: Digital Omnibus proposal COM(2025) 837 (opens in a new tab)Art. 3(8), amendment of Art. 33 GDPR, accessed October 25, 2026
- European Parliament, Legislative Observatory: 2025/0360(COD) (opens in a new tab)Status of the procedure on October 25, 2026
This checklist is a TOMORIS recommendation and does not replace legal advice. The GDPR and the NISG 2026 as currently in force and the decision in the individual case are authoritative. The EDPB guidelines are guidance that the Data Protection Authority also refers to; notification channels and forms of the Data Protection Authority may change.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 reporting deadline calculator (German)
Deadlines from the time of awareness
Check Now NIS2 reporting obligations
Early warning, notification and final report under the NISG 2026 with deadlines, contents and recipients.
Learn MoreRansomware: first aid
What matters in the first hours after a ransomware attack and what you should avoid.
Learn MoreGDPR
The EU General Data Protection Regulation briefly explained: scope, principles and obligations.
Learn More
NIS2 & COMPLIANCE
More on
This Topic.
- PDF
NIS2 Reporting Obligations
Early warning within 24 hours, notification within 72 hours, final report after one month: deadlines, content, and recipients with references to the NISG 2026, plus a checklist.
View - PDF
NIS2 Incident Report
A worksheet for emergencies: master data, a significance checklist under the NISV 2026, fields for the early warning, notification, and final report, customer information, a GDPR review, and a log.
View - PDF
Supplier Security Questionnaire
Fill-in questionnaire for IT service providers and suppliers: organization, access, vulnerabilities, incident reporting, audit rights and termination, based on NISG 2026 and IR (EU) 2024/2690.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.