Reporting a data breach: when you must and how to do it
An email with a customer list to the wrong recipient, a stolen laptop or a letter to the wrong address: a data breach happens easily. The GDPR sets out exactly what you must do next. This article explains when to report a breach, to whom, and how to prevent the next one.
What is a data breach?
The GDPR speaks of a "personal data breach" (Article 4(12)): a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It doesn't have to be a hack. A misdirected letter or unintentionally sharing data with an external service, such as an AI chatbot, can also be a breach.
Reporting to the supervisory authority
Under Article 33 GDPR the controller reports a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. You don't have to report it if the breach is unlikely to result in a risk to people's rights and freedoms. If you report after 72 hours, give the reasons for the delay.
The report includes the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken. If you don't have all the information yet, you may provide it in phases.
Informing the people affected
If the breach is likely to result in a high risk, for example with health data, financial data or ID numbers, you must also inform the people affected without undue delay (Article 34 GDPR). This is not required if, for example, the data was properly encrypted or you have taken measures that mean the high risk is no longer likely to materialise.
Always: the breach log
Breaches you don't have to report must still be documented internally: the facts, the effects and the remedial action (Article 33(5) GDPR). This lets you show the supervisory authority that you comply. Acting as a processor for another organisation? Then notify your client without undue delay (Article 33(2)).
Common causes
According to the Dutch Data Protection Authority's 2024 data breach report, in the health, public administration and financial sectors about half of the notifications concerned a letter sent to the wrong recipient, and about 15% a misdirected email. The authority also received several reports in 2024 of employees entering personal data into AI chatbots; read Using ChatGPT under the GDPR.
How to prevent breaches when sharing documents
- Share only what the recipient really needs (data minimisation, Article 5 GDPR).
- Anonymise or pseudonymise documents before sharing them with external parties or AI tools. VerumVault does this locally, without uploading.
- Check the recipient before you hit send, and use bcc for group emails.
- Encrypt laptops and USB sticks.
Read also: GDPR for small businesses and Redacting national ID numbers.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no accountFrequently asked questions
How quickly must I report a data breach?
Without undue delay and, where feasible, within 72 hours of becoming aware of it, to the supervisory authority. Later reporting is possible, but with reasons for the delay.
Do I have to report every data breach?
No. You don't have to report it if it is unlikely to result in a risk to the people concerned. You must, however, log every breach internally.
When must I inform the people affected?
When the breach is likely to result in a high risk to them, for example with health or financial data or ID numbers.
Is a misdirected email a data breach?
Yes, if it contained personal data. Whether you must report it depends on the risk to the people concerned.