{"id":43533,"date":"2026-03-17T08:00:27","date_gmt":"2026-03-17T06:00:27","guid":{"rendered":"https:\/\/2b-advice.com\/?p=43533"},"modified":"2026-04-14T14:28:01","modified_gmt":"2026-04-14T12:28:01","slug":"reporting-a-data-breach-correctly-reporting-process-according-to-dsgvo-with-deadlines-assessment-and-documentation","status":"publish","type":"post","link":"https:\/\/2b-advice.com\/en\/2026\/03\/17\/datenpanne-richtig-melden-meldeprozess-nach-dsgvo-mit-fristen-bewertung-und-dokumentation\/","title":{"rendered":"Report a data breach correctly: Reporting process according to GDPR with deadlines, evaluation and documentation"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t

\n\t\t\t\t\t\t\tMarcus Belke\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Data breaches are now one of the most common compliance incidents in organizations. Technical security incidents, misconfigurations of IT systems or human error can lead to the unauthorized disclosure, modification or loss of personal data. However, such an incident only becomes relevant under data protection law if it qualifies as a personal data breach within the meaning of Art. 4 No. 12 GDPR. In practice, it is not so much the abstract legal situation as its organizational implementation that poses the greatest challenge. Incidents must be assessed, reporting obligations checked, measures documented and communication decisions made within a short space of time. Below you will find an overview of the relevant points.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Reporting deadlines and start of deadline in the event of a data breach<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The GDPR's notification system distinguishes between notification to the supervisory authority pursuant to Art. 33 GDPR and information to data subjects pursuant to Art. 34 GDPR.<\/p>

Art. 33 para. 1 GDPR obliges the controller to notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The notification may be omitted if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the deadline is exceeded, the delay must be justified.<\/p>

The start of the period is not linked to a complete clarification of the incident. According to the guidelines of the European Data Protection Board, a data breach is considered \u201eknown\u201c as soon as the controller has sufficient certainty that a security incident has occurred that affects the protection of personal data. A brief initial assessment is permitted, but must begin immediately.<\/p>

Processors are subject to an upstream obligation under Art. 33 para. 2 GDPR: they must notify the controller immediately of any data breach of which they become aware. In complex organizational structures, this often results in an internal escalation process that precedes the actual 72-hour deadline.<\/p>

Notification of data subjects in accordance with Art. 34 GDPR is only required if there is a high risk to their rights and freedoms. It must be carried out immediately, provided that no legal exceptions apply, for example if suitable technical protection measures - such as encryption - make the data inaccessible to unauthorized persons.<\/p>

In addition to the GDPR, there may be additional notification obligations. For example, Regulation (EU) No. 611\/2013 contains a separate notification system with particularly short deadlines for providers of publicly available electronic communications services. In addition, cybersecurity law provides for a tiered reporting system for significant security incidents for certain entities under the BSIG.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Assessment and risk decision<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The central legal challenge in the event of data breaches lies in risk assessment.<\/p>

The first step is to check whether there has been a personal data breach within the meaning of Art. 4 No. 12 GDPR. Not every IT security incident fulfills this requirement.<\/p>

If such a breach has occurred, it must be examined whether this results in a risk to the rights and freedoms of natural persons. Only in this case is there an obligation to notify the supervisory authority.<\/p>

Only when the valuation results in a high risk<\/strong> If this leads to a data breach, an additional obligation to inform the persons concerned is triggered.<\/p>

Possible consequences of damage play a particular role in the risk assessment. These include identity theft, financial losses, discrimination, damage to reputation or other material or immaterial disadvantages.<\/p>

For organizational implementation, a structured assessment model is recommended that combines the probability of occurrence and the severity of the damage, while also taking into account protective measures that have already been implemented.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Documentation and verification of a data breach<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The documentation of data breaches is a legal obligation in its own right.<\/p>

Art. 33 para. 5 GDPR obliges controllers to document all data breaches, including their causes, effects and remedial measures. The documentation must enable the supervisory authority to verify compliance with legal obligations.<\/p>

In telecommunications law, Section 169 TKG supplements this obligation with a register of data protection violations. However, this does not have to take into account incidents that occurred more than five years ago.<\/p>

Securing technical evidence is of particular importance. Uncontrolled countermeasures can destroy digital traces and make subsequent clarification more difficult. For this reason, incident management should already specify the conditions under which forensic investigations are to be initiated.<\/p>

An additional protection mechanism arises from Section 42 (4) BDSG. According to this provision, reports pursuant to Art. 33 GDPR may not be used against the data subject in criminal proceedings without the data subject's consent. This provision is intended to promote open communication with supervisory authorities.<\/p>

Reading tip: Technical and organizational measures - what companies need to consider<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Communication with authorities and affected parties<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The communication obligations are regulated in detail in Art. 33 and 34 GDPR.<\/p>

A notification to the supervisory authority must contain the following information in particular:<\/p>