Legally classify a data protection incident

Data Breach Check: 72-hour deadline, risk and immediate measures

The Data Breach Check helps businesses quickly structure a possible data protection incident: what happened, which data is affected, how large is the group concerned, which notification and information obligations may apply and which evidence should be secured immediately? It also shows which immediate measures have priority within the 72-hour deadline.

Start the check

GDPR Art. 33/34
72-hour review
Incident file
Data subject information gate
As of 24 October 2026

For acute and unclear data protection incidents

Suitable for hacking, ransomware, misdirected mail, lost devices, open links, misconfigurations and notifications from service providers. The check does not replace an individual review, but provides a robust preliminary structure for data protection, IT security, management and coordination with lawyers. What to do in an emergency is described on our page Help with a data breach; if you are in contact with the authority, our support in dealings with the supervisory authority.

Bring together deadlines, types of data, the group of data subjects and containment.
Derive a provisional risk level and the next review priorities.
Generate a copyable short overview for an inquiry or an internal incident file.

Incident countdown

72-hour window, risk traffic light and data subject information gate

The visualisation shows the typical review path after discovery: secure immediately, decide within the 72-hour window on a notification to the supervisory authority and, if a high risk is likely, also consider informing the data subjects.

Enter the time at which your organisation became aware with reasonable certainty of the personal data breach (Art. 4(12) GDPR). The countdown calculates the deadline under Art. 33(1) GDPR in German time (Europe/Berlin), the risk traffic light takes your answers from the questionnaire below and the gate shows whether data subjects must also be notified under Art. 34 GDPR. All details stay in your browser; nothing is stored or transmitted.

Data breach review path

Keep awareness, risk, notification and evidence clearly separate.

1. Time of awareness

Date and time (German time)

According to EDPB Guidelines 9/2022, the decisive point is when the controller is reasonably certain that a breach has occurred. A short investigation may postpone the start, deliberate waiting may not. For processors, what counts is the controller's own awareness, which regularly occurs with the notification under Art. 33(2) GDPR.

2. Risk assessment Source of the assessment

To the questionnaire – every answer updates the traffic light immediately.

3. Exceptions to informing data subjects (Art. 34(3) GDPR) a) The affected data is rendered unintelligible to unauthorised persons by state-of-the-art encryption or comparable means, and the key has not been compromised. b) Subsequent measures ensure that the high risk is no longer likely to materialise. c) Individual notification would involve disproportionate effort (in which case a public communication or an equally effective measure is required). The information would disclose information that must be kept secret by law (Section 29(1) sentence 3 BDSG, with a counter-exception where the data subjects' interests prevail).

4. Status and parallel reporting channels (optional) The notification to the data protection authority has already been submitted. We are an essential or important entity under NIS2/BSIG and there is a significant security incident. We are a financial entity within the scope of DORA. We are the manufacturer of a product with digital elements and the incident concerns the product (CRA).

Art. 33(1) GDPR · without undue delay and where feasible within 72 hours

remaining until the end of the 72-hour window

Deadline: –

10–24 hSecureContain, secure evidence, gather facts
224–72 hNotification reviewAssess the risk, submit the notification or justify not notifying
3>72 hReasonsLate notification only with reasons, Art. 33(1) sentence 2
4GateData subjects?If the risk is high, notify without undue delay, Art. 34

Risk

No riskprobably – document only, Art. 33(5)

RiskNotification to the authority, Art. 33

High riskalso inform data subjects, Art. 34

Not yet assessed – answer the questionnaire or choose your own assessment.

Data subject information gate: open

The decision depends on the risk assessment.

Time windowNot yet assessed

Risk pressureNot yet assessed

Next focusAnswer the questions

Next steps

Parallel reporting obligations

Tick whether NIS2/BSIG, DORA or CRA may apply to you. These reports run alongside the GDPR notification and do not replace it. More detail: Reporting a cyber incident: deadlines under NIS2, GDPR, DORA and CRA (in German).

Summary for the incident file

Art. 33(5) GDPR requires every breach to be documented with facts, effects and remedial action, even if it is not notified. This summary is one building block for that.

Summary

Outlook: Digital Omnibus – 96 hours and a "high risk" threshold (not yet applicable law)

On 19 November 2025, the Commission proposed amending Art. 33 GDPR in the Digital Omnibus (procedure 2025/0360(COD)): notification to the authority only where a high risk is likely, a deadline of 96 instead of 72 hours, a common EU notification form and a single reporting point. On 21 October 2026, the Council adopted its negotiating position; it supports the 96 hours and the high-risk threshold, but replaces the EU-wide reporting point with national entry points and a pure information point at ENISA. The European Parliament has not yet adopted its position, and trilogue negotiations have not begun. As of 24 October 2026, the 72-hour deadline with the "risk" threshold therefore continues to apply unchanged; this countdown calculates according to current law.

Orientation: five steps after discovery

In data breaches, it is not only the technical findings that count. What matters is the time of awareness, the risk to data subjects, containment, documentation and the question of whether the supervisory authority or data subjects need to be informed.

1SecureStop access, isolate systems, secure evidence, logs and the state of communications.
2ClarifyRecord types of data, data subjects, causes, service providers and actual awareness.
3AssessReview and justify the risk to the rights and freedoms of natural persons.
4DecidePrepare the notification to the authority, notification of data subjects and a possible follow-up notification.
5EvidenceDocument the incident file, measures, deadlines, responsible persons and follow-up checks.

What this check does

The check is designed for businesses, associations, agencies, platforms, employers, SaaS providers, cloud users and other controllers who need to classify a possible loss, unauthorised access, misdirected mail or service provider incident.

What is reviewed?

The check reviews the type of incident, data categories, scope, timing, containment, evidence, service provider involvement and typical interfaces with IT security, the data protection authority, communication with data subjects, the contractual situation and reputational risks.

When is the check relevant?

The check is relevant in particular for hacking, ransomware, publicly accessible directories, misdirected mail, lost devices, compromised accounts, incorrectly set permissions or notifications from a processor.

What are the limits of the check?

The evaluation is a structured initial assessment. A robust decision depends on specific data flows, technical evidence, risk impact, responsibilities, countries, contractual roles and the exact time of awareness.

When does the 72-hour deadline start?

The deadline starts as soon as the controller knows with reasonable certainty that a personal data breach has occurred (EDPB Guidelines 9/2022). A short, prompt investigation may postpone the start, deliberate waiting may not. If a processor notifies under Art. 33(2) GDPR, the controller's deadline generally starts with that notification. The 72 hours run continuously, including weekends and public holidays.

Does every data breach have to be notified?

No. Notification to the supervisory authority is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Under Art. 33(5) GDPR, however, every breach must be documented with facts, effects, remedial action and the reasons for the decision.

When do data subjects not have to be notified?

Notification under Art. 34 GDPR is only required where a high risk is likely. Under Art. 34(3) GDPR it is not required if the data is inaccessible, for example through encryption, if subsequent measures eliminate the high risk or if individual notification would involve disproportionate effort; a public communication is then required. Section 29(1) sentence 3 BDSG contains a narrowly limited exception for statutory confidentiality obligations.

Does the 96-hour deadline from the Digital Omnibus already apply?

No. The Digital Omnibus is a Commission proposal of 19 November 2025. The Council adopted its position on 21 October 2026, the European Parliament has not yet done so. Until adoption and entry into application, Art. 33 GDPR continues to apply unchanged with 72 hours and the "risk" threshold.

Select your concern

Choose the most obvious starting point. The selection sets the first review points in the form, but can be adjusted at any time afterwards.

Acute attack, ransomware or extortion For ongoing attacks, exfiltration, publication, encryption or threats to publish data.

Misdirected mail, wrong recipient or open link For emails, files, letters, portals, links or permissions that became accessible to the wrong people.

Notification from a service provider or processor For incidents at hosting, SaaS, newsletter, IT support, agency, cloud, payroll or other service providers.

Unclear situation with possible personal data For suspected cases in which types of data, access, scope or actual risks have not yet been reliably narrowed down.

Interactive questionnaire

Classify a data breach in a structured way

Answer the following steps. The result assesses the details cautiously according to risk signals, deadline pressure, types of data and measures already taken.

Step 1 of 5

1. What happened?

Choose the focus of the incident. If there are several causes, the most critical finding counts first.

Hacking, unauthorised access or compromised accountAn account, system, mailbox, admin access or service may have been used by third parties. Ransomware, exfiltration or extortionData was encrypted, copied, published or there was a threat of publication. Misdirected mail or wrong recipientAn email, letter, file, link, export or portal access went to the wrong recipients. Lost device, storage medium or documentsA laptop, smartphone, USB stick, files, printouts or backup media have been lost. Misconfiguration, open link or public directoryData was publicly accessible or accessible to too many internal or external people. Incident at a service provider or processorA provider reports a security incident, data access, loss, misconfiguration or service compromise.

2. Which data is affected?

Multiple selection is possible. If the types of data are still unclear, select "Unclear" for now.

Contact, customer or user dataName, address, email, phone number, customer number, account data or usage data. Login, password, token or access dataPasswords, API keys, session tokens, MFA data, recovery codes or admin access. Financial, payment or contract dataIBAN, payment status, invoices, contracts, creditworthiness, orders or billing data. Special categories or very sensitive dataHealth, biometric or genetic data, religion, trade union membership, sex life, political opinions or comparably sensitive information. Data of children, employees or vulnerable personsMinors, employees, applicants, patients, clients or other vulnerable groups. Confidential communication or trade secretsHR documents, strategy, source code, draft contracts, legal correspondence, M&A, product data or internal communication. Unclear or not yet classifiedIt is not yet known for certain exactly which data is affected.

3. How large is the possible scope?

Choose the most reliable current estimate. If the number is open, the uncertainty should be documented.

Fewer than 10 peopleSmall incident that can be specifically narrowed down. 10 to 100 peopleManageable group with an organisational need for review. 100 to 1,000 peopleLarger incident with possible external impact. More than 1,000 peopleLarger or mass incident. Unknown or still openThe scope cannot currently be determined with certainty.

4. When did the incident become known?

What usually matters is when the organisation became aware of a possible incident involving personal data and was able to initiate a risk review.

Less than 24 hours agoInternal awareness is very recent. 24 to 72 hours agoThe notification deadline may already be running. More than 72 hours agoThe incident has been known for some time. The incident is ongoing or has not been containedAccess, publication, misdirected mail or the attack may be ongoing. Report came from a customer, authority, the press or a service providerThird parties already know about the incident or are asking about it.

5. Which measures have already been taken?

Multiple selection is possible. If nothing has been done in a structured way yet, select only the last option.

Incident contained technically or organisationallyAccess closed, systems isolated, sending stopped or permissions corrected. Encryption, remote wipe or access protection can be provenIn particular for lost devices, storage media or mobile devices. Logs, screenshots and evidence securedTechnical and organisational evidence is available. Data protection, legal, IT security or management informedInternal escalation has taken place. Data subjects and types of data are largely knownThe group of data subjects and data categories have been narrowed down. Authority or data subjects have already been informedThere has already been a notification, information or contact. No structured measures yetNothing has yet been documented, assessed, contained or notified.

Deadlines, risks and measures

The table helps classify typical review paths. It does not replace a decision in the individual case, but helps with prioritisation, documentation and preparing an inquiry.

Review point	Typical trigger	Deadline / timing	First measure	Priority
Notification to the supervisory authority	A risk to the rights and freedoms of natural persons cannot be ruled out; notification is only unnecessary if the breach is unlikely to result in a risk	Where feasible within 72 hours of awareness, Art. 33 GDPR; at the same time without undue delay (Art. 33(1) sentence 1), after 72 hours only with reasons for the delay (sentence 2), information can be provided in phases (para. 4)	Prepare the risk assessment, draft notification, reasons and any follow-up notification	Immediately
Notification of data subjects	Likely high risk, for example due to sensitive data, access credentials, risk of misuse or publication	Without undue delay, Art. 34 GDPR; no fixed deadline in hours	Review the group of data subjects, content, protective recommendations and communication channel	Very high
Documentation of the incident	Every personal data breach, even if not notified	On an ongoing basis from discovery, Art. 33(5) GDPR	Create an incident file with facts, assessment, decision and measures	High
Incident at the processor	Service provider reports a security incident or data loss	Without undue delay to the controller, Art. 33(2) GDPR; also check contractual deadlines	Request the DPA, subprocessors, technical details and times	High
Cybersecurity interface	Significant security incident, critical services, NIS2/BSIG scope or product with digital elements	Check additional reporting obligations depending on the role	Coordinate NIS2, CRA, DORA or contractual reporting channels in parallel with data protection	More detail
Exceptions to notification	Effective encryption, subsequent elimination of the high risk, disproportionate effort; statutory confidentiality under Section 29(1) sentence 3 BDSG	Before omitting notification, Art. 34(3) GDPR	Prove and justify the conditions; in the case of disproportionate effort a public communication; the authority may require notification under Art. 34(4)	High
NIS2 / Section 32 BSIG	Significant security incident at an essential or important entity	Early warning within 24 hours, notification within 72 hours of awareness, final report one month after the notification	Notification to the joint reporting office of the BSI and BBK in parallel with the data protection notification; neither replaces the other	Immediately
DORA	Major ICT-related incident at a financial entity	Initial notification within 4 hours of classification, at the latest 24 hours from awareness; intermediate report within 72 hours; final report after one month (Art. 19 DORA, Art. 5 Delegated Regulation (EU) 2025/301)	Classification under Delegated Regulation (EU) 2024/1772 and notification to BaFin; in the financial sector DORA displaces the BSIG report, the GDPR notification remains	Immediately
Use of the notification	Concern about incriminating oneself by notifying	With every notification and communication	Section 43(4) and Section 42(4) BDSG: use in administrative offence or criminal proceedings against the notifying party only with their consent; the scope with regard to fines under Art. 83 GDPR is disputed	More detail
Outlook: Digital Omnibus	Commission proposal 2025/0360(COD) of 19.11.2025, Council position of 21.10.2026	Proposed: 96 hours and notification only where a high risk is likely; not yet applicable law	Until adoption and entry into application, Art. 33 GDPR continues to apply unchanged with 72 hours	More detail

Sensible next steps

Related ITMR checkers and follow-up reviews

GDPR Role SimulatorClarify whether a controller, processor or joint controllership is involved. DPA CheckReview service providers, subprocessors, reporting chains and data protection contracts after an incident. DPIA CheckCheck whether processing, types of data or protective measures point to a high risk. NIS2 CheckAssess cybersecurity applicability, reporting channels and management duties in parallel with the GDPR. Document Dossier BuilderPrepare the incident file, evidence, logs, communication and decision papers in a structured way. Review and Defamation CheckClassify reputational risks, press inquiries, platform reports or public allegations after an incident.

Short overview for your inquiry

The short overview summarises your details for a structured inquiry. Add specific times, systems, contact persons and documents before sending it.

Please answer the review questions first. A copyable short overview will then appear here.

Start an inquiry

Contact and further support

In the case of an ongoing attack, a possible 72-hour deadline, sensitive data, access credentials, publication, a service provider notification or contact with authorities, the legal classification should be combined promptly with technical preservation of evidence and communication planning.

Have a data breach legally classified Open general contact

The check is intended for initial orientation. The specific legal classification depends on the facts, deadlines, data flows, the contractual situation, countries, target groups and technical implementation.