Personal data breaches under GDPR - what to do

01

What counts as a personal data breach?

GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, or to unauthorised disclosure of or access to it. So it is not only about hacking. Common examples:

• An email containing personal data is sent to the wrong recipient.
• A laptop, phone or USB stick containing personal data goes missing.
• An intrusion or ransomware attack leaks data or makes it unavailable.
• Misconfigured permissions let unauthorised people see data.
• Data is deleted by mistake and cannot be restored.

02

Notifying IMY within 72 hours

Under Article 33, the controller must notify IMY without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of individuals. If you notify after 72 hours you must explain the delay, and if you don't have all the information you can supplement it later. The notification must include:

• What happened, which categories of data subjects and data are affected, and approximately how many.
• Contact details of the data protection officer or another contact point.
• The likely consequences of the breach.
• The measures taken or planned to address the breach and mitigate its effects.

03

When must data subjects be informed?

If the breach is likely to result in a high risk to individuals, Article 34 requires you to also inform them without undue delay, in clear and plain language, so they can protect themselves - for example by changing passwords or watching out for fraud attempts. This is not required if the data was protected so it is unintelligible to unauthorised persons (for example encrypted), if subsequent measures mean the high risk is no longer likely to materialise, or if it would involve disproportionate effort - in which case you must make a public communication instead.

04

Document even when you don't notify

Article 33(5) requires all personal data breaches to be documented: what happened, its effects and the remedial action taken. This includes breaches you have assessed as not requiring notification, and the reasoning behind that assessment should be recorded too. The documentation must enable IMY to verify compliance.

05

How it differs from NIS2 reporting

If you are covered by the Cybersecurity Act, the same event may need to be reported twice. A personal data breach goes to IMY within 72 hours. A significant incident under the Cybersecurity Act is reported to CERT-SE in three steps: early warning within 24 hours, incident notification within 72 hours and a final report within one month. The assessments differ - GDPR is about the risk to individuals, the Cybersecurity Act about the impact on services.

06

Checklist for your incident routine

A working routine makes 72 hours enough. Make sure you have:

• A clear way for staff to raise the alarm internally, around the clock if needed.
• A designated person who assesses the risk and decides on notification.
• Contact details for your data protection officer, IT suppliers and processors.
• Requirements in processor agreements that processors notify you without undue delay.
• A template for the incident log and for informing data subjects.
• A follow-up after every incident: what needs to change so it doesn't happen again?