5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Data breach assistance
Act calmly, but do not wait.
Misdirected email, compromised account, open cloud link, ransomware or a service provider incident. As soon as personal data may be affected, time pressure arises. We help you find a robust line for notification and communication.
Please enter your number first.
The first contact is free of charge. We will inform you expressly before any costs arise for you.
Go to the data breach risk check
As of: 23 October 2026
Cloud provider customer serviceMon 09:12
We have detected unusual access to a customer account. The scope is still being reviewed.
Head of ITMon 10:40
Affected is probably the export with customer data. Log files are not yet available.
ManagementMon 11:05
Do we have to report this and when does the deadline start?
Time of awareness: The 72-hour deadline may run from 09:12
- 1Secure the incidentIncident, data, times
- 2Clarify the duty to notifyNotify or document
- 3Implement the responseAuthority, data subjects, customers
Schematic illustration of an incident timeline. Simplified example.
We support data breaches at
- Mid-sized companies
- SaaS providers
- Healthcare
- Platforms
- Agencies
What should you do right now?
- Note when the incident became known. Notification to the supervisory authority must be made within 72 hours of becoming aware, where possible. Art. 33 GDPR
- Isolate affected systems without deleting log files and traces.
- Document every step with the time. The GDPR requires this documentation even if no notification is needed.
Key points at a glance
- Not every data breach must be notified, but every data breach must be properly reviewed and documented.
- Under Art. 33 GDPR, notification to the supervisory authority is generally required within 72 hours of becoming aware if a risk to data subjects is not unlikely.
- At ITMR, we clarify risk, notification, data subject information and communication in one coordinated line.
- You can request a callback directly using the form.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- TOM
- Technical and organisational measures. Companies use them to protect personal data.
Acute data breach
What tips a data breach in practice?
In our experience, a data breach is rarely just about whether anything is notified. The situation becomes critical when the deadline, facts, risk assessment, service provider information and external communication do not fit together.
As soon as the 72-hour deadline is running, every step should be documented and aligned with the notification.
A personal data breach is not merely an IT problem. As soon as personal data may have been destroyed, lost, altered, disclosed or accessed without authorisation, the company must check whether notification to the supervisory authority and communication to data subjects are required.
The focus is on a robust risk assessment. Which data are affected, how sensitive are they, who had access, how likely is misuse, which countermeasures are effective and what consequences threaten data subjects? The first response also influences later situations involving fines, damages, contracts and reputation.
If a cyber incident affects data protection, communication and contracts at the same time, our legal war room for acute situations organises the situation. For a quick pre-structuring of the incident, data types and notification deadline, you can use our data breach risk check.
- Start of deadline unclear
- Nobody can say for sure when the company had sufficient knowledge of the incident.
- Facts incomplete
- IT, data protection, management and service providers work with different information on systems, data types and cause.
- Communication under pressure
- Customers, data subjects, the authority, insurers or the media ask questions before the internal line is robust.
- Service provider affected
- A processor, cloud provider or SaaS tool reports late, briefly or inconsistently.
- High risk exposure
- Login credentials, communication content, employee, health or payment data increase the pressure to decide.
The right order protects more than hectic completeness
Record the type of incident, data types, group of data subjects, systems, service providers, times and countermeasures.
Assess the likelihood and severity of possible consequences for data subjects in a structured way and decide on notification.
Keep the authority, data subjects, customers, service providers and insurers apart and record decisions, measures and approvals robustly.
Request a callback directly
Enter your number above or in the form and briefly describe the incident. We will call you to agree the next steps.
How it works
How is the response line created in three steps?
You request a callback. In the call, we clarify the situation, deadline and next steps.
01
Secure the incident You describe what happened, when the incident became known and which systems, data, people, service providers and measures taken so far are affected.
- AwarenessMon 09:12
- DataCustomer export
02
Clarify the duty to notify We review Art. 33 and 34 GDPR, risk level, deadline, responsibility, content of a notification, data subject information and external communication.
- Art. 33
- Notification likely
- Art. 34
- still to be reviewed
03
Implement the response You receive a clear line for notification, documentation, measures, internal approval and dealing with the authority, data subjects, customers or service providers.
The response in detail
- 1
Triage We record the incident with the affected data, people, systems and times.
- 2
Risk Assess the likelihood and severity of possible consequences for data subjects in a structured way.
- 3
Communication Keep the authority, data subjects, customers, service providers, insurers and internal stakeholders properly apart.
- 4
Evidence Document decisions, measures, approvals and open points robustly.
Support
How do we support you in an acute situation?
Service package: help with a data breach
Legal first triage Classification of the incident based on the GDPR, the authorities' standards and the actual situation.
Notification decision Assessment of whether notification to the supervisory authority is required or whether not notifying can be robustly justified and documented.
Notification under Art. 33 GDPR Drafting or reviewing the notification, including open points and planned follow-up notifications.
Informing data subjects Assessment of whether and how data subjects must be informed under Art. 34 GDPR.
Communication line Coordination towards customers, service providers, insurers, the authority and internal bodies.
Documentation Recording the risk assessment, measures and approvals for later situations requiring evidence or defence.
- For whom
- Companies and organisations with a possible data protection incident
- Service
- First triage, notification decision, notification, data subject information and communication line
- Contact
- Callback via the form; phone number is a required field
- Initial contact
- Free of charge, to clarify the situation and the next step
- Costs
- We inform you expressly in advance. Only then do you decide.
- Not included
- Technical forensics and incident response. This is a separate service, on request and as needed.
Who delivers what and who decides
- Incident timeline and times of awareness
- Technical first assessment and affected systems
- Data categories and number of data subjects
- Service provider information, DPA and TOMs
- Legal risk assessment
- Notification and follow-up notifications
- Communication with data subjects and customers
- Documentation of decisions
- Your management decides on notification and communication
- The supervisory authority decides on further measures
How does the engagement work?
- 1
First assessment We review your information and tell you whether the package fits or another route makes more sense.
- 2
Offer for the package If the package fits, you receive a quote for the first assessment, draft notification and communication line. We only start after your approval.
- 3
Court steps separately Proceedings before the supervisory authority or in court, and representation in them, are not part of the package. We agree these steps separately.
Initial assessment
What must be legally in place in the first hours?
Under time pressure, the longest statement is not what matters, but a controlled process that remains traceable later towards the authority, data subjects, customers or a court.
| Review question | What matters | Typical mistake |
|---|---|---|
| Is there a personal data breach? | Confidentiality, integrity or availability may be affected. A misdirected email, loss, wrong permissions, an open link or unauthorised access can be enough. | The incident is treated as a purely technical problem, although GDPR obligations apply in parallel. |
| Is notification under Art. 33 GDPR required? | Notification may be required if a risk to the rights and freedoms of natural persons is not unlikely. | The decision not to notify is made hastily without traceably documenting the risk assessment. |
| Must data subjects be informed under Art. 34 GDPR? | Communication becomes relevant if a high risk is likely. Content, tone and timing must fit the risk situation. | Data subjects are informed too early, too late or with contradictory statements. |
| Which information is still missing? | A notification in phases can make sense if the facts are not yet established but a notifiable situation is likely. | The company waits for perfect technical certainty and loses control of the deadline. |
| Who must approve internally? | Legal, data protection, IT security, management, communication and affected business units must work along one line. | One area communicates externally while others are still working from different facts. |
Typical case groups
Typical data breach cases in companies
The triggers differ. In all cases, the legal review follows the same logic of data, risk, deadline and communication.
Misdirected emails and wrong access Emails, attachments, applicant, employee or customer data end up with the wrong recipients or in groups with overly broad permissions.
Compromised accounts Phishing, stolen credentials, unclear login activity or admin access make the question urgent of which data may be affected.
Open links and cloud shares Storage locations, ticket systems, collaboration tools or data rooms are shared incorrectly or open for longer than intended.
Ransomware and cyberattack Incident response and data protection law converge when data may have been encrypted, copied, published or exfiltrated.
Service provider and DPA incidents Processors report an incident but do not provide sufficient information for your own risk assessment.
Loss of data and devices Laptops, storage media, smartphones, printouts or backups are lost. Encryption, access protection and risk of misuse become decisive.
After the first response
What follows after the first response?
Many data breaches are not over after the first notification. Supervisory authorities follow up, data subjects demand access or damages, customers expect explanations and internal processes must visibly improve.
Facts, risk, measures and open points are organised so that follow-up questions remain answerable.
Data subjects, customers, management, customer service and the public do not receive contradictory statements.
Documentation, approvals and measures help to classify allegations, claims and later escalations.
Legal support should not slow down the technical handling of the incident. It translates technical findings into a decision line that is consistent, proportionate to the risk and fit for next steps.
Robust starting points
Legal bases for notification and communication
For the first legal line, Art. 4(12), Art. 33 and Art. 34 GDPR and the European Data Protection Board's guidelines on personal data breach notification are particularly relevant.
The 72-hour deadline starts as soon as the controller becomes aware of the breach. A notification can be supplemented in phases if not all information is available yet.
- GDPR (EU) 2016/679 on EUR-Lex Official text, in particular Art. 4(12), Art. 33 and Art. 34.
- EDPB Guidelines 9/2022 on personal data breach notification Guidelines of the European Data Protection Board with examples of risk assessment.
- LDI NRW on data breaches Notes from the NRW State Commissioner for Data Protection on the notification obligation for controllers.
Interfaces
When is another ITMR page a better fit?
Not every situation after an incident is an emergency. These routes fit when the focus lies elsewhere.
- 1
Cybersecurity For ransomware, NIS2, IT security law, management duties, supply chain and incident response structure.
- 2
Defend against GDPR damages claims When claims, letters of demand, lawsuits or mass data subject claims threaten after the data breach.
- 3
Privacy litigation When fine proceedings, defence in court or a litigation-proof line are the focus.
- 4
Data protection audit When processes, evidence, TOMs, roles and training need to be tightened in a structured way after the incident.
Mistakes that make data breach cases unnecessarily expensive
- Lawyers involved too late. The incident is handled technically while the deadline, authority, data subjects and documentation are only considered later.
- Unclear times of awareness. Internal reports, service provider notifications, ticket statuses and management information are not properly recorded in time.
- Notification too general. The notification describes the incident without a clear risk assessment, status of measures, open points and a plan for follow-up notifications.
- All-clear given too quickly. No risk is assumed although the type of data, access possibilities, scope or group of data subjects are not yet clear.
- Contradictory communication. The authority, data subjects, customers, customer service, sales and management receive statements that do not follow the same line.
- Weak follow-up. Measures, responsibilities, DPA issues, TOMs, training and process corrections remain open.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“My concern was not only resolved extremely quickly, but also at the highest professional level. Communication was clear, friendly and efficient.” (translated from German)
“An absolute recommendation. Absolute reliability and excellent client care come first here. Always reachable and qualified staff who prepare you perfectly for the case.” (translated from German)
“…after about 2 weeks, my profile was open again and almost fully usable… After trying again and again for 4 years to find a solution through META support or on my own, and already despairing, this was the only right decision.” (translated from German)
FAQ
Frequently asked questions about data breaches
Does every data breach have to be notified to the supervisory authority?
No. It depends on whether the breach is likely to result in a risk to the rights and freedoms of natural persons. Without a robust risk assessment, however, not notifying is dangerous, because the company will later have to explain why notification was not required.
When does the 72-hour deadline start?
What matters is when the controller became aware of the breach. In practice, it must therefore be documented precisely when which department or service provider had which information and from when a robust picture of the incident existed.
We show how the deadlines under the GDPR, NIS2, DORA and the CRA overlap in the article Report a cyber incident.
Can we notify even though not all details are known yet?
Yes, that can make sense. If a notifiable situation is likely, an initial notification with later follow-up notifications can be a better line than risky waiting. Content and tone must then be set particularly carefully.
When must data subjects be informed?
When the breach is likely to result in a high risk. What matters are the type of data, scope, risk of misuse, safeguards and possible consequences such as identity theft, financial loss, discrimination or reputational damage.
What if a processor reports the data breach?
The controller must clarify whether the information is sufficient, which of its own obligations are triggered and which information must be requested. DPAs, TOMs, incident clauses, sub-processors and the actual data flow then become relevant.
Is ransomware automatically notifiable?
Not automatically, but in our experience it very often requires intensive review. It depends on whether personal data are affected, whether access, loss, encryption, exfiltration or publication was possible and which risks arise for data subjects.
Should we inform data subjects as a precaution?
Precautionary communication can build trust, but can also trigger unrest, queries, demands or contradictions. The decision should depend on the risk situation, the state of knowledge and a coordinated communication line.
Which documents help with a quick review?
Incident timeline, technical first assessment, affected systems, data categories, number of data subjects, service provider information, measures taken so far, DPA, TOMs, internal communication and any existing drafts of the notification or data subject information.
How does the callback work?
Enter your phone number and a short description in the form. We call you back, clarify the facts and discuss which steps come first. We will point out explicitly before any services that incur fees.
Concrete next step
Classify the data breach before statements create facts
Once an incident is known, the legal line should not emerge on the side. Duty to notify, communication with data subjects, documentation, service provider information and internal approvals belong on a common basis.
Helpful for the callback
- Time of becoming aware of the incident
- Affected systems and data types
- Estimated number of data subjects
- Notification or information from the service provider
- Measures taken so far
An incomplete picture is enough for the callback. We will clarify the rest in the call.
Request a data breach callback
Leave your number and a short description of the incident.
Helpful are the time of awareness, affected systems and data types and measures taken so far.
Related services
Data protection law GDPR compliance, proceedings before authorities, data subject rights and data protection organisation beyond the incident.Cybersecurity Security incidents, ransomware, NIS2 and incident response structure.Defend against GDPR damages claims When claims, letters of demand or lawsuits threaten.Privacy litigation Data protection disputes and fine proceedings.Data processing agreement When service providers, DPAs, TOMs or incident obligations are the weak point.Data protection audit Tighten processes, evidence and training after the incident.Fight banking fraud Review bank liability.
From our blog: Data breach risk check · Legal war room for acute situations · Report a cyber incident · CJEU on damage and burden of proof