Data breaches: when you must report and to whom

The short answer

When a security incident touches personal data, there are usually four audiences with different triggers and deadlines. The supervisory authority must be notified within seventy-two hours of becoming aware, unless you can demonstrate the breach is unlikely to result in a risk to people’s rights and freedoms; a later notification must state the reasons for the delay. The people affected must be told without undue delay when the risk is likely to be high, unless an exception applies such as the data being unintelligible through encryption or subsequent measures removing the risk. Business customers whose data you process must be told under the timelines in your processing agreements, which are often shorter than the regulator’s and occasionally measured in hours. And your insurer must be notified under the policy’s clause, where late notice can reduce or void cover. Those clocks run at the same time, which is why the decision should follow a written test rather than a feeling, and why the reasoning is recorded whether or not you notify. A phased notification within the deadline is expressly permitted and always better than a complete one that is late.

The decision, in order

Question	If yes	If no
Is personal data involved, including loss of availability?	Continue	Still an incident; handle and record
Was the data effectively protected, for example strongly encrypted with keys uncompromised?	Risk may be reduced; assess and record	Continue
Can you demonstrate the breach is unlikely to result in a risk to people’s rights and freedoms?	Document the assessment and the reasons; do not notify	Notify the supervisory authority within 72 hours of awareness
Is a high risk likely?	Also inform the people affected without undue delay	Individual notice not required; consider it anyway if it helps them
Is any of the data processed on behalf of a business customer?	Notify them under the agreement’s timeline, usually faster	No contractual notification
Does a cyber policy cover this?	Notify the insurer per the policy	No
Are payment, platform or sector rules engaged?	Follow those procedures	No

Getting the order right

Telling people well

When individual notice is required, be direct and early: what happened, when, what data was involved, what could follow, what you have done, what they should do, and a named contact who will answer. Avoid minimising, avoid technical detail that obscures, and do not wait for complete information if that means waiting days. People and regulators both judge the handling more than the incident, and a clear early message is the most effective thing you can do for your position and for the people affected.

What this means for you

Decide notifiability with a written test: personal data involved, protection applied, risk likely, high risk likely, and then work outwards to customers, insurers and sector rules. Record the moment of awareness and the reasoning either way. Notify the authority within seventy-two hours where required, in phases if necessary, meet the shorter contractual deadlines, and tell affected people plainly when the risk is high. This is general information rather than legal advice.