Data Breach Under the GDPR: Checklist for the First 72 Hours

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data (Art. 4(12) GDPR). According to the Data Protection Authority, it does not matter whether it happens accidentally or through fault. The EDPB distinguishes three types (Guidelines 9/2022):

When do the 72 hours start? According to the EDPB, as soon as the controller has a reasonable degree of certainty that a security incident has compromised personal data. A short investigation into whether a breach has occurred at all is permitted and should start as soon as possible. One incident can affect confidentiality, integrity and availability at the same time.

• Indication recorded (who, when, what), management and data protection officer informed.
• Briefly investigated whether personal data is affected; time of awareness recorded.
• Type of breach determined: confidentiality, integrity, availability or several.
• Immediate measures taken to address the breach and mitigate its effects, such as blocking access, asking the recipient to delete the data, restoring data from backup.
• Risk assessed and decision on notification and communication documented with reasons.
• Where a data processing agreement (DPA) is in place: the processor has reported without undue delay (Art. 33(2)) or has been asked to cooperate.

You must assess the likelihood and severity of possible consequences for the data subjects, not for the business. Unlike a data protection impact assessment, this concerns an event that has already occurred. The EDPB recommends considering these criteria (Guidelines 9/2022, Section IV):

• Type of breach: disclosure of health data has a different impact than its loss.
• Nature, sensitivity and volume of the data: health, identity and financial data, combinations of data, even seemingly harmless data with revealing content.
• How easily individuals can be identified; appropriately encrypted data is unintelligible to unauthorized persons without the key.
• Severity and duration of the consequences: identity theft, fraud, physical harm, psychological distress, reputational damage; whether the data is with trusted or unknown recipients.
• Special characteristics of the data subjects, such as children or other vulnerable individuals, and of the controller, such as a medical institution.
• Number of affected individuals.

When in doubt, the EDPB advises erring on the side of caution and notifying (Guidelines 9/2022, para. 119).

The examples show the logic but do not replace a case-by-case assessment. Even small differences, such as whether a backup exists, whether data was exfiltrated or whether it was encrypted, change the outcome.

• Nature of the breach described, where possible with the categories and approximate number of data subjects and records concerned (Art. 33(3)(a)).
• Name and contact details of the data protection officer or another contact point provided (point (b)).
• Likely consequences described (point (c)).
• Measures taken or proposed to address the breach and, where appropriate, to mitigate its effects described (point (d)).
• If information is still missing: notify in phases and provide the rest without undue further delay (Art. 33(4)).
• After 72 hours have passed: reasons for the delay attached (Art. 33(1)).
• Notification channel chosen: online form or PDF form of the Data Protection Authority, email to dsb@dsb.gv.at or letter to the Data Protection Authority, Barichgasse 40-42, 1030 Vienna.
• Cross-border processing: notified to the lead supervisory authority (EDPB 9/2022, para. 69).
• Copy of the notification and, if available, proof of sending filed.

After notification, the Data Protection Authority checks whether the minimum information has been provided and appropriate measures have been taken. Only if this is not the case will it contact you and request additional information; otherwise it closes the proceedings informally. Processors notify the controller without undue delay (Art. 33(2)); the EDPB recommends regulating this in the contract and providing information in phases.

• If there is likely to be a high risk, data subjects informed without undue delay (Art. 34(1)).
• Nature of the breach described in clear and plain language (Art. 34(2)).
• Contact point, likely consequences and measures taken stated (Art. 34(2) with Art. 33(3)(b) to (d)).
• Specific recommendations given, such as changing passwords or watching out for fraud attempts (EDPB 9/2022, para. 87).

The Data Protection Authority can require you to communicate the breach after the fact (Art. 34(4)); according to its guidance, it does so by official decision. Infringements of Art. 33 and 34 can lead to fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Art. 83(4)(a) GDPR).

The controller documents every breach with all the facts, its effects and the remedial action taken; this must enable the Data Protection Authority to verify compliance (Art. 33(5)). The EDPB recommends an internal register of all breaches, including those not subject to notification; it may be part of the record of processing activities if the entries are clearly identifiable.

• NIS2: Essential and important entities also report significant cybersecurity incidents to the CSIRT: early warning within 24 hours, notification within 72 hours, final report no later than one month after the notification (§ 34 NISG 2026, Austrian Network and Information Systems Security Act 2026). Both obligations apply side by side; the authorities cooperate under § 21 NISG 2026.
• Police: According to the EDPB, victims of cybercrime should file a report with the law enforcement authorities.

Reform in progress: The Digital Omnibus proposal COM(2025) 837 would limit notification to breaches likely to result in a high risk, extend the deadline to 96 hours and provide for a single reporting point. On October 25, 2026, procedure 2025/0360(COD) was awaiting the committee decision in Parliament. Until the change applies (according to the proposal, 18 months after entry into force), Art. 33 GDPR remains authoritative.