# Data breach: what to do in the first 72 hours URL: https://pulsaiq.com/en/guides/data-breach-72-hours/ Last reviewed: 2026-10-23 Language: en Legal basis: GDPR Art. 33 and 34 A calm, hour-by-hour plan for when something goes wrong with personal data. With the EDPB's decision logic, real cases from its guidelines, and the exact information your notification needs. ## In two minutes - **Always record it.** Every personal data breach goes in your internal breach register, including the ones you don't have to report. Art. 33(5) - **Notify your supervisory authority within 72 hours** of becoming aware, unless the breach is unlikely to result in a risk to people. The 72 hours include the weekend. Art. 33(1) - **Tell the people affected** without undue delay when the risk is high, in clear and plain language. Art. 34(1)–(2) - **Don't wait for the full picture.** You can notify in phases and add details later. Art. 33(4) - **If in doubt, notify.** That is the EDPB's own advice. Guidelines 9/2022, para. 119 **Who this is for:** SME managers, IT teams and data protection officers (DPOs) who need to know what to do right now. If your organisation only acts as a processor, your main duty is to tell your client without undue delay (section 2). ## Is this a data breach? The GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12)). No hacker is required. The EDPB sorts breaches into three types (Guidelines 9/2022, para. 17): - **Confidentiality:** someone saw what they shouldn't have. An email to the wrong person, a shared folder with an open link, a stolen laptop. - **Integrity:** data was changed without authorisation. For example, a supplier's bank details swapped in a payment fraud. - **Availability:** data could not be accessed, even temporarily. Ransomware, or a file deleted with no backup. Planned maintenance doesn't count (para. 21). An email sent to the wrong person is a confidentiality breach. The data was disclosed to someone with no right to see it, even if that person means no harm. ## When the 72 hours start The deadline runs from the moment the organisation **becomes aware** of the breach. For the EDPB, that is when you have "a reasonable degree of certainty that a security incident has occurred" that compromised personal data (Guidelines 9/2022, para. 31). In practice there are two situations. When the error is obvious, like a sent email, you are aware straight away. When there is only a warning sign, like an antivirus alert, you may run a short investigation to confirm. That investigation has to start promptly and can't become a way to buy time. **Weekends count.** Regulation No 1182/71, which sets the rules for time limits in EU law, says periods include public holidays, Sundays and Saturdays unless they are expressed in working days (Art. 3(3)). The GDPR deadline is in hours. If Rui found out at 17:40 on Friday, the deadline is 17:40 on Monday at the latest. **If you are a processor** (an IT provider or an email marketing platform, for example), you must tell your client, the controller, without undue delay (Art. 33(2)). From that moment, your client's clock is running (Guidelines 9/2022, para. 44). That is why processor contracts should set a short deadline for this notice. ## The 72 hours, hour by hour This split is not in the law. It is a practical way to make sure you have the facts you need when it is time to decide.
Became awareFri 17:40
Deadline to notifyMon 17:40
The 72 hours include the weekend.
  1. Hour 0 to 4

    Contain

    • Stop the damage: recall the email, ask the recipient to delete it, take the device off the network, change passwords.
    • Tell whoever makes decisions, and your DPO.
    • Open the incident log with the exact time you became aware.
    • Keep the evidence. Don't delete system logs.
  2. Hour 4 to 24

    Assess

    • Which data, and how many people?
    • Any special category, financial or children's data?
    • Who had access, and what could they do with it?
    • Have your measures already reduced the risk?
  3. Hour 24 to 72

    Decide and notify

    • Classify the risk (section 4).
    • If needed, notify the authority. In Portugal, that is the CNPD's online form.
    • If the risk is high, prepare the message to the people affected.
    • Record the decision and the reasons, whatever you decide.
## Risk in three levels The question is not "how bad is this for the company?" It is "what could happen to the people whose data was involved?" The EDPB asks you to weigh the type of breach, the nature, sensitivity and volume of the data, how easily people can be identified, how severe the consequences could be, any special characteristics of the people (children, for example) or of your organisation, and the number of people affected (Guidelines 9/2022, paras. 105–118).
Question 1Is the breach likely to result in a risk to people's rights and freedoms?
No likely risk

Record it internally

It goes in the breach register, with the reasons for your decision. No notification.

Art. 33(5)
Question 2, if yesIs that risk high?
Risk

Record and notify the authority

Within 72 hours. If you are late, explain why.

Art. 33(1)
High risk

Also tell the people affected

Without undue delay, unless an Art. 34(3) exception applies (see section 7).

Art. 34(1)
**Want to put numbers on it?** The EDPB points to the method published by ENISA, the EU Agency for Cybersecurity, as useful (Guidelines 9/2022, para. 120). It scores severity with the formula **SE = DPC × EI + CB**. DPC rates the type of data from 1 to 4, EI is how easily people can be identified (0.25 to 1), and CB adds points for the circumstances, such as disclosure to unknown recipients or malicious intent. A score below 2 means low severity, 2 to 3 medium, 3 to 4 high, and 4 or more very high ([ENISA, 2013](https://www.enisa.europa.eu/publications/dbn-severity)). The score helps you justify the decision, but it doesn't make it for you.

Stuck between two levels? Choose the stricter one. "If in doubt, the controller should err on the side of caution and notify" (Guidelines 9/2022, para. 119).

## How the EDPB decides similar cases The EDPB's [Guidelines 01/2021](https://www.edpb.europa.eu/system/files/documents/2022-01/edpb_guidelines_012021_pdbnotification_adopted_en.pdf) work through 18 practical cases. We picked the ones a small business is most likely to meet. The facts are summarised; the verdict is the EDPB's. | Situation | What decided it | EDPB verdict | |---------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|------------------------| | **Ransomware at a small manufacturer**, with a recent backup and no data taken case 01 | Logs showed no data left the network. The backup restored everything within hours. A few dozen people, no impact on operations. | Record only | | **Two tablets stolen from a nursery**, encrypted, switched off and protected by strong passwords case 10 | The data was unreadable to the thief, backups existed, and the devices were wiped remotely. | Record only | | **Laptop stolen with no encryption or password**, holding data on over 100,000 customers case 11 | Anyone could read names, addresses and dates of birth. Large volume, risk of identity theft. | Notify and tell people | | **Course participant list** sent by mistake to 15 former participants, including two food intolerances case 15 | Error spotted at once, recipients told and asked to delete. Little data, not very sensitive. | Record only | | **Email to 60,000 jobseekers** with an attachment holding all their data, including social security numbers case 14 | Huge volume, a sensitive identifier, and no way to make sure recipients deleted it. | Notify and tell people | Notice the pattern. Encryption and backups change the outcome. The same mistake, such as an email to the wrong person, can go from "record only" to "notify and tell people" depending on volume, sensitivity, and whether you can make sure the data was deleted. ## What to put in the notification Each authority has its own form. In Portugal it is the [CNPD's breach form](https://www.cnpd.pt/databreach/); elsewhere in the EU, use your lead or local authority's form. Whatever the form, the GDPR requires at least four elements (Art. 33(3)). Have these answers ready before you open it: 1. **What happened.** The nature of the breach, the categories and approximate number of people and records involved.Example: "Customer file containing name, address, phone number and order history of about 300 customers sent by email, by mistake, to an external contact." 2. **Who to contact.** Name and contact details of the DPO or another contact point.Example: "Inês \[surname\], DPO, \[email\], \[phone\]." 3. **Likely consequences.** What could happen to the people.Example: "Risk of fraudulent contacts impersonating the company. No payment data involved." 4. **Measures taken or proposed.** To deal with the breach and limit its effects.Example: "Recipient asked to delete the file, confirmation expected on the first working day; review of the rules for sending files with customer data." **Don't know everything yet?** Send what you know within the deadline and complete it later. The law allows the information to be provided in phases without further undue delay (Art. 33(4); Guidelines 9/2022, para. 56). If you notify after 72 hours, you must give the reasons for the delay (Art. 33(1)). ## When and how to tell the people affected When the risk is high, you must tell the people affected without undue delay (Art. 34(1)). The message must use clear and plain language, describe the nature of the breach, and include elements 2, 3 and 4 from the notification (Art. 34(2)). Add what people can do: be wary of calls asking for personal details, change their password, keep an eye on their bank account. If, after your notice, someone asks which of their data was affected, handle it as an access request, with its one-month deadline. You don't need to tell people individually in three situations (Art. 34(3)): - the data was protected so that it is unintelligible to anyone not authorised to see it, for example with strong encryption; - you have since taken measures that mean the high risk is no longer likely to materialise; - contacting each person would involve disproportionate effort. You then make a public announcement or use another equally effective measure. Even when it isn't required, telling people can be the right call when their help reduces the risk. In case 13 of Guidelines 01/2021, about two orders sent to the wrong customers, the EDPB found that contacting both customers could not be avoided to put things right. ## One wrong email, from start to finish How the steps in this guide apply to a concrete case, from Friday afternoon to Monday morning.
Oficina RochaFurniture maker near Braga, in northern Portugal, with an online shop

  1. Friday

    Section 2 · The clock

    17:40 Rui looks after IT at Oficina Rocha. A message comes in from a colleague in sales: "I think I sent the customer file to the wrong Ana." The spreadsheet held the names, addresses, phone numbers and order histories of 300 customers. It was meant for Ana in accounts. It went to Ana Ferreira at a delivery company they work with.

    17:46 Rui calls Marta, the office manager who "also does GDPR". Marta asks the three questions everyone asks. Does this count as a data breach? Who do we call? And does the weekend count towards the 72 hours? Yes. Inês, the company's external DPO. And yes, it does.

  2. Saturday

    Section 4 · The decision

    10:00 Inês runs the assessment with Marta over the phone. It is contact and purchase data for 300 people, with no payment details and no special category data. The recipient is a known business contact, but the only reply to Rui's email was an out-of-office: "On holiday until Monday." Nobody can confirm the file was deleted.

    "Addresses, phone numbers and what each person bought. Someone could pretend to be us and scam our customers," says Inês. "I don't see a high risk. But I can't say there's no risk either."

    ENISA scale2.25 · medium severity
    DecisionNotify the CNPD before the deadline, don't contact customers for now, and reassess if there are signs of misuse. Everything goes in the register, with the reasons.

    If Ana had replied on Friday evening to confirm she had deleted the file, the assessment could have ended like case 15: record only.

  3. Monday

    Section 6 · Notify

    09:30 Marta submits the notification, with eight hours to spare.

    10:15 Ana Ferreira is back from holiday, reads Rui's email and confirms in writing that she deleted the email and the attachment. Inês sends that confirmation to the CNPD as additional information and updates the register.

Oficina Rocha, Marta, Rui and Inês are fictional. The rules and the cases cited are real.

## Most breaches don't start with an attack In 2025, Portugal's data protection authority, the CNPD, opened 472 breach cases, 42% more than the 332 of 2024. Confidentiality was affected in 390 of them. These were the most common causes reported by organisations: | Reported cause (2025) | Cases | |---------------------------------------------|-------| | Human error | 128 | | Phishing or social engineering | 72 | | Malware | 49 | | Ransomware | 47 | | Fraud (misuse of resources, identity theft) | 33 | Source: [CNPD, Activity Report 2025](https://www.cnpd.pt/media/v50frkwy/relatorio-atividades-de-2025.pdf) (in Portuguese), pp. 35–36. The CNPD notes that causes are as declared by the organisations and may understate reality. The lesson for a small business is simple. Your most likely incident is not a sophisticated attack. It is someone sending the wrong file, clicking a fake link, or sharing a folder with the wrong people. That is where preparation should start. ## If your organisation is also covered by NIS2 Essential and important entities under the NIS2 Directive have a separate reporting track for significant cybersecurity incidents: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month (Directive (EU) 2022/2555, Art. 23). In Portugal the directive was transposed by Decree-Law No 125/2025 of 4 December, and the national cybersecurity authority is the CNCS. A ransomware attack can trigger both reports, one to the data protection authority and one to the cybersecurity authority. They are separate duties with different content. Keep a single incident log that serves both, and check with your national cybersecurity authority (in Portugal, the [CNCS](https://www.cncs.gov.pt/pt/diretiva-nis-2/)) whether your organisation is covered. ## An EU proposal would simplify these rules On 19 November 2025 the European Commission published the Digital Omnibus proposal, [COM(2025) 837](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837), which amends the GDPR. For data breaches, it proposes: - notifying the authority only when a breach is likely to result in a **high risk**, the same threshold that applies today to telling people; - extending the deadline from **72 to 96 hours**; - a **single EU entry point** for notifications and a common template prepared by the EDPB. **Where it stands:** in the European Parliament, the ITRE and LIBE committees have not yet voted on their report. In the Council, member states' ambassadors were discussing a negotiating mandate in October 2026. After that come negotiations between the institutions and publication in the Official Journal. **What to do today:** follow the current rules. Until a final text is published, the 72 hours and the "risk" threshold still apply. And the internal record of every breach stays in every version under discussion. The same proposal also changes access requests. We explain both changes in our article on the Digital Omnibus. Sources: [European Parliament, procedure 2025/0360(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)); [Council, Coreper agenda of 21 Oct 2026](https://data.consilium.europa.eu/doc/document/ST-14633-2026-INIT/en/pdf); [EDPB-EDPS Joint Opinion 2/2026](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf). ## Get ready in an hour, today Oficina Rocha met the deadline because Rui knew who to call. Authorities expect every controller to have an internal procedure to detect and handle incidents. It doesn't need to be a 40-page manual. Start with a card pinned up next to the coffee machine, and a breach register with four columns: the facts, the effects, the action taken, and your decision on notification with the reasons (Art. 33(5)). It also helps to know in advance what data you hold and where: that is what your record of processing activities tells you, and it is the first thing you will open when you assess a breach. ### Data breach card (pin this up) 1. Have you stopped the damage? Email recalled, device off the network, passwords changed. 2. Call [name and phone] and the DPO [name and phone]. 3. Write down the time you found out. The 72 hours start there and include the weekend. 4. Don't delete anything: emails, system logs, messages. 5. Breach register: [where it is]. ## Before you close the incident - I recorded the exact time we became aware. - I contained the breach and kept the evidence. - I identified the data, the people affected and roughly how many. - I assessed the risk against the EDPB criteria and wrote down the reasons. - If there was a risk, I notified the authority within 72 hours, or explained the delay. - If the risk was high, I told the people affected in plain language, or documented the exception. - If I notified in phases, I sent the missing information. - I checked whether NIS2 also applies. - I updated the breach register. - I decided what changes so it doesn't happen again. ## Frequently asked questions ### Do the 72 hours count over the weekend and on public holidays? Yes. The deadline runs in consecutive hours and includes Saturdays, Sundays and public holidays (Regulation No 1182/71, Art. 3(3)). If you found out at 17:40 on a Friday, you have until 17:40 on Monday to notify the supervisory authority. ### I emailed personal data to the wrong person. Do I have to notify? It depends on the risk, but you always have to record it. A short list, with data that isn’t very sensitive and a recipient who confirms straight away that they deleted it, can stay in the internal record only (case 15 of Guidelines 01/2021). A lot of data, sensitive data or no way to make sure it was deleted means notifying the authority and, if the risk is high, telling the people affected (case 14). ### What if I still don’t know everything after 72 hours? Notify anyway, with what you know. The GDPR lets you provide the information in phases without further undue delay (Art. 33(4)). Waiting for a complete report is the most common way to miss the deadline. ### Does a breach with no risk still have to be recorded? Yes. Every personal data breach goes in the internal record, with the facts, the effects, the action taken and the decision not to notify, with the reasons (Art. 33(5)). The supervisory authority can ask for that record to check compliance. ### Who notifies the authority when the breach happens at a supplier? The controller, that is, the supplier’s client. The processor must tell the controller without undue delay (Art. 33(2)), and the controller’s 72 hours run from that notice. If you are the DPO of several organisations, agree with each one who tells whom and how fast: the guide for external DPOs with several clients shows how to triage when everything arrives at once. ## Sources ### EU and national law - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679), Articles 4, 33 and 34 (EUR-Lex) - [Regulation (EEC, Euratom) No 1182/71](https://eur-lex.europa.eu/eli/reg/1971/1182/oj/eng), rules on periods, dates and time limits, Art. 3 (EUR-Lex) - [Directive (EU) 2022/2555 (NIS2)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj), Art. 23 (EUR-Lex) - [Decree-Law No 125/2025 of 4 December](https://diariodarepublica.pt/dr/detalhe/decreto-lei/125-2025-962603401) (Diário da República, in Portuguese) ### EDPB and ENISA - [Guidelines 9/2022 on personal data breach notification, version 2.0](https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en) - [Guidelines 01/2021 on examples regarding personal data breach notification](https://www.edpb.europa.eu/system/files/documents/2022-01/edpb_guidelines_012021_pdbnotification_adopted_en.pdf) - [EDPB, data breaches at a glance](https://www.edpb.europa.eu/system/files/2026-10/edpb_guidelines-at-a-glance_data_breaches_en.pdf) - [ENISA, Recommendations for a methodology of the assessment of severity of personal data breaches (2013)](https://www.enisa.europa.eu/publications/dbn-severity) - [EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) ### Supervisory authorities - [CNPD (Portugal), data breaches](https://www.cnpd.pt/organizacoes/outras-obrigacoes/violacao-de-dados-ou-data-breach/) and [notification form](https://www.cnpd.pt/databreach/) (in Portuguese) - [CNPD, Activity Report 2025](https://www.cnpd.pt/media/v50frkwy/relatorio-atividades-de-2025.pdf) (in Portuguese) - [ICO (UK), Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/). Useful plain-English reading; note that it applies the UK GDPR, which follows the same Art. 33 and 34 rules but has its own regulator. - [CNCS (Portugal), NIS 2 Directive](https://www.cncs.gov.pt/pt/diretiva-nis-2/) (in Portuguese) ### Pending proposals - [COM(2025) 837, Digital Omnibus proposal](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837) - [European Parliament, procedure 2025/0360(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)) - [Council of the EU, Coreper agenda, 21 Oct 2026](https://data.consilium.europa.eu/doc/document/ST-14633-2026-INIT/en/pdf) **Last reviewed:** 21 October 2026. This guide is general information and is not legal advice on any specific case. If you are facing a real breach, talk to your DPO or a lawyer. The people and the company in the scenes are fictional.