Knowledge · Data protection· 5 min read
Reporting obligation after a hack: what the GDPR requires
If personal data is put at risk in an attack, such as customer data, orders or contact enquiries, the GDPR's reporting obligations apply. The deadlines are short, so it pays to know the basics.
When a report may be necessary
Article 33 GDPR requires a personal data breach to be reported to the competent supervisory authority, where feasible within 72 hours of becoming aware of it. Exceptions are cases where the breach is unlikely to result in a risk to the persons concerned.
- A shop in whose checkout payment data was skimmed.
- A database of customer accounts to which the attacker had access.
- A contact form whose enquiries were forwarded to third parties.
When affected persons must be informed
If there is likely to be a high risk to the rights of those affected, Article 34 GDPR additionally requires these persons to be notified themselves, in clear and plain language.
What you should document
- The time at which the incident was noticed.
- Which systems and which types of data could be affected.
- How the attacker presumably got in.
- Which measures were taken for containment and clean-up.
- Who was informed internally and which decisions were made.
Technical basis
The report requires a reliable technical description of the incident. A proper analysis provides exactly this information.
Note
This page is not a substitute for legal advice. The legal assessment is up to your data protection officer or a law firm.