A data breach: 72 hours, and what to do in them
The clock starts when the breach becomes known, not when it is understood. Waiting until everything is clear usually means the deadline has already passed – yet an incomplete notification is expressly provided for.
A personal data breach is more than a hacking attack. It covers any destruction, loss, alteration and unauthorised disclosure – whether deliberate or accidental.
That puts the majority of cases not under "attack" but under "mishap": the e-mail to the wrong distribution list, the open folder on the server, the lost laptop, the accidentally deleted database with no backup.
The first 72 hours
- ContainStop the leak first: close the access, revoke the share, change the passwords. Before any documentation.
- EstablishWhich data, how many people, what period, who had access. Rough figures suffice at first.
- Assess the riskFrom the perspective of the people affected. Encrypted data with a safe key carries a different risk than plain names in the open.
- NotifyTo the competent supervisory authority where a risk exists. Incomplete notifications are permitted and completed later.
- DocumentEvery breach, including those not reported. The decision not to report is itself subject to documentation.
Two thresholds, not one
Notifying the authority and informing the people affected
To the supervisory authority
To the people affected
Threshold: a risk exists
Threshold: a <em>high</em> risk exists
Deadline: 72 hours from becoming aware
Deadline: without undue delay
Content: nature of the breach, scale, consequences, measures, contact point
Content: the same, but in clear and plain language
Only dispensable where a risk is unlikely
Also dispensable with effective encryption or subsequent measures
What can be prepared in advance
- The competent authority and its notification form – finding that out while the clock runs costs hours.
- A record of processing activities – without it there is no saying which data is affected.
- An escalation path that works on a Saturday evening too, with a deputy named.
- A template for informing the people affected – written calmly, not under pressure.