Marcus Belke
CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.
Data breaches are now among the most common Compliance-Incidents within organizations. Technical security incidents, misconfigurations of IT systems, or human error can lead to personal data are disclosed, altered or lost without authorization. However, such an incident only becomes relevant under data protection law if it is considered a breach of the protection of personal data within the meaning of Art. 4 No. 12 GDPR. GDPR is to be qualified. In practice, it is not so much the abstract legal situation as its organizational implementation that poses the greatest challenge. Incidents have to be assessed, reporting obligations checked, measures documented and communication decisions made within a short space of time. Below you will find an overview of the relevant points.
Reporting deadlines and start of deadline in the event of a data breach
The reporting system of the GDPR distinguishes between reporting to the Regulatory Authority pursuant to Art. 33 GDPR and the information of data subjects in accordance with Art. 34 GDPR.
Art. 33 para. 1 GDPR requires the controller to report a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Regulatory Authority to report. The report may be omitted if the breach is not expected to pose a risk to the rights and freedoms of natural persons. If the deadline is exceeded, the delay must be justified.
The start of the deadline is not linked to a complete clarification of the incident. According to the Guidelines of the European Data Protection Board, a data breach is considered „known“ as soon as the Responsible persons has reasonable certainty that a security incident has occurred that compromises the protection of personal data. A brief initial assessment is permitted, but it must begin immediately.
Processors are subject to Art. 33 para. 2 GDPR an upstream obligation: they must report a data breach of which they become aware to the controller without delay. In complex organizational structures, this often results in an internal escalation process that precedes the actual 72-hour deadline.
Notification of the data subjects in accordance with Art. 34 GDPR is only required if there is a high risk to their rights and freedoms. It must be carried out immediately, provided that no legal exceptions apply, for example if suitable technical protective measures - such as Encryption – prevent unauthorized persons from accessing the data.
In addition to the GDPR additional notification obligations may exist. For example, Regulation (EU) No. 611/2013 contains a separate notification system with particularly short deadlines for providers of publicly available electronic communications services. In addition, cybersecurity law provides for a tiered reporting system for significant security incidents for certain entities under the BSIG.
Assessment and risk decision
The central legal challenge in the event of data breaches lies in risk assessment.
It must first be examined whether there has been a breach of the protection of personal data within the meaning of Art. 4 No. 12 GDPR is present. Not every IT security incident fulfills this requirement.
If such a violation occurs, it must be determined whether it poses a risk to the rights and freedoms of natural persons. Only in this case does an obligation to report to the Regulatory Authority.
Only when the valuation results in a high risk If this occurs, it also triggers an obligation to inform the affected individuals.
In risk assessment, potential consequences of harm play a particularly important role. These include, for example, identity theft, financial losses, discrimination, damage to one’s reputation, or other material or immaterial disadvantages.
For organizational implementation, a structured assessment model is recommended that combines the probability of occurrence and the severity of damage while also taking into account protective measures that have already been implemented.
Documentation and Record-Keeping for a Data Breach
The Documentation Reporting data breaches is a separate legal obligation.
Art. 33 para. 5 GDPR obligated Responsible persons, to document all data breaches, including their causes, effects, and corrective measures. The Documentation it must be the Regulatory Authority enable verification of compliance with legal obligations.
In telecommunications law, Section 169 of the Telecommunications Act (TKG) supplements this obligation with a record of data breaches. However, this record does not have to include incidents that occurred more than five years ago.
Securing technical evidence is of particular importance. Uncontrolled countermeasures can destroy digital traces and complicate subsequent investigations. Therefore, the conditions under which forensic investigations are initiated should be established as early as the incident management phase.
An additional protection mechanism arises from Section 42 (4) BDSG. According to this, notifications pursuant to Art. 33 GDPR may not be used against the reporting party in criminal proceedings without their consent. This regulation is intended to promote open communication with supervisory authorities.
Reading tip: Technical and Organizational Measures—What Companies Need to Know
Communication with Government Agencies and Those Affected
The communication obligations are set out in Art. 33 and 34 GDPR regulated in detail.
A message to the Regulatory Authority must contain the following information in particular:
- a description of the nature of the data breach,
- Information on data categories and groups of persons concerned,
- Contact details of a contact point,
- a description of possible consequences, as well as
- Information on countermeasures that have already been taken or are planned.
If not all the information is available immediately, it can be submitted in stages.
The information provided to the affected individuals must be in clear and simple language and, in particular, explain the nature of the breach, its potential consequences, and the recommended protective measures.
If the effort involved is disproportionate, a public announcement may be used in lieu of individual notification.
Lessons learned: Post-incident review
Data breaches should not only be reported, but also systematically evaluated.
A post-incident review should, in particular, examine,
- whether deadlines have been met correctly,
- whether the time of disclosure was correctly determined,
- whether the risk decision is documented in a comprehensible manner and
- whether communication with government agencies and affected parties was conducted in a legally sound manner.
For organizational management, key metrics such as the time to the first risk assessment, the time to reporting to regulatory authorities, or the consistency between the internal situation assessment and external communications can be used.
Incident Playbook as a Precaution Against Data Breaches
Structured handling of data protection violations requires a binding Incident playbook. This was intended to translate the legal decision-making process into operational procedures and define clear areas of responsibility.
Such a playbook should contain in particular
a definition of data breach in accordance with Art. 4 No. 12 GDPR
A timeline matrix for reporting requirements
a documented evaluation process for risk and high-risk decisions
Communication modules for authorities and Affected parties
Procedure for preserving evidence and subsequent notification
A structured reporting process is therefore not only a legal obligation, but a central component of modern data protection and security governance.
2B Advice helps organizations develop and implement such incident playbooks—from the legal framework to practical implementation within the company. If you have any questions or are interested in a structured solution for handling data breaches, please feel free to contact us.
Marcus Belke is CEO of 2B Advice and a lawyer and IT expert for Data protection and digital Compliance. He writes regularly about AI governance, GDPR-Compliance and risk management. You can learn more about him on his Author profile page.
German 
English 
Italian 
French