Personal data breach: what to do

What the Law requires

1. 01Notifying the Centre on time. The controller notifies the National Centre for Personal Data Protection without undue delay and, where possible, not later than 72 hours from the date on which it became aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A notification made after 72 hours is accompanied by a reasoned explanation of the delay. art. 33
2. 02The minimum content of the notification. The notification describes the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, gives the contact details of the data protection officer or another contact point, and describes the likely consequences of the breach and the measures taken or proposed to address it. Where not all of the information can be provided at the same time, it may be provided in phases without undue delay. art. 33
3. 03Informing the data subjects when the risk is high. If the breach is likely to result in a high risk to their rights and freedoms, the data subjects are informed without undue delay. This is not required in the cases set out in the law, for example where the affected data were protected by measures that render them unintelligible to unauthorised persons, such as encryption. art. 34
4. 04Documenting every case. The controller keeps documents on every personal data breach, including those it does not notify, describing the facts, the effects and the remedial action taken, so that the Centre can verify compliance with these obligations. art. 33
5. 05Notice from the processor. If the breach occurs at a processor, such as your IT provider or accounting firm, the processor notifies you without undue delay after becoming aware of it. art. 33