Everyday agents · Privacy · European Union
What do I have to do after a personal data breach?
- What applies?
- A controller must notify the supervisory authority of a personal data breach unless it is unlikely to result in a risk to people, and must inform the affected people when the risk is high.
- What must I do?
- Assess the risk to the people affected. Notify the supervisory authority. Inform affected people without undue delay when the risk is high. Document every breach, its effects and the remedial action.
- What happens if I do nothing?
- Fines of up to 10 million euro or 2 percent of worldwide annual turnover, whichever is higher.
- Who regulates this?
- The national data protection authority (supervisory authority)
- What is the deadline?
- Without undue delay and where feasible within 72 hours of becoming aware of the breach.
Sources
Read 2026-10-14 · ID agent:eu:everyday:data-breach-notification · sha256 9f2c6458478264e7a820e585b90ab5d6bd84497fd1a9007ae667d913e5d55e2e
Related
- agent:eu:everyday:mortgage-credit (agent)
- agent:eu:everyday:vat-invoicing (agent)
- agent:us:everyday:children-online-privacy (agent)
- card:eu:article:gdpr--art-33 (knowledge_card)
- card:eu:article:gdpr--art-34 (knowledge_card)
- question:eu:everyday:data-breach-notification#1 (question)
- question:eu:everyday:data-breach-notification#2 (question)
- question:eu:everyday:data-breach-notification#3 (question)
Read next
Court decisions
- C-340/21 VB v Natsionalna agentsia za prihodite (Court of Justice of the EU, 2023-12-14)
A breach does not by itself prove that security measures under Article 32 were inadequate; the controller bears the burden of proving they were appropriate.
- C-687/21 BL v MediaMarktSaturn Hagen-Iserlohn GmbH (Court of Justice of the EU, 2024-01-25)
Personal data sent to the wrong third party by mistake; assessment of Articles 32 and 82.
- C-741/21 GP v juris GmbH (Court of Justice of the EU, 2024-04-11)
Non-material damage under Article 82 and when the controller can be exempted from liability.
- C-590/22 AT and BT v PS GbR and Others (Court of Justice of the EU, 2024-06-20)
Non-material damage and how the amount of compensation is assessed under Article 82(1).
Machine readable: JSON. Not legal advice. Source: NovaCopilot.