A "personal data breach" under GDPR is broader than most people assume: it's any accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data. A lost laptop, an email sent to the wrong recipient, a leaked spreadsheet, or ransomware all count — not just large-scale hacking. The moment anyone on your team becomes aware, a clock starts. Here's what actually has to happen next.
Notify within 72 hours unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)). Ask yourself:
If there's any real risk — the normal case for anything short of fully encrypted, unreadable data — notify. When genuinely unsure, notify anyway: the penalty for failing to report a real breach is typically worse than the friction of reporting one that turns out to be low-risk. If you can't finish your assessment within 72 hours, notify anyway with your reasons for the delay (Art. 33(1) allows a phased notification) — don't wait for a complete picture before the first report.
Separately, Art. 34 requires notifying affected individuals directly, without undue delay, only if the breach is likely to result in a HIGH risk to them — a higher bar than the Garante notification above. Ask:
You're exempt from notifying individuals if the data was encrypted/unintelligible to whoever accessed it, if you've since taken measures that remove the high risk, or if direct notice would take disproportionate effort — in which case a public notice (e.g. a site-wide banner) can substitute, as long as it informs people just as effectively.
| Question | If yes |
|---|---|
| Any real risk to affected people? | Notify the Garante within 72h |
| High risk specifically (sensitive data, real harm possible)? | Also notify affected individuals directly |
| Data was fully encrypted, key never exposed? | Often exempt from both — document why |
Art. 33(5) requires you to document every breach internally — including ones you decide not to report to anyone. The Garante can ask to see this log at any time, and "we didn't think it was serious enough to write down" is not a defensible answer if they do. At minimum, record: when discovered, when it happened, how it was discovered, what data and how many people were affected, your risk assessment and reasoning, whether you notified the Garante and/or individuals (and when), and what you did to contain it and prevent it recurring.
A breach-response plan sits alongside your other GDPR paperwork, not instead of it. If a breach happens, you'll likely also need to check your Privacy Policy covers what you told people about your security measures, and — if the breach happened at a processor working on your behalf (a developer, host, or agency) — your DPA should already specify their own breach-notification obligation back to you.
NormaKit is a bilingual (EN/IT) GDPR document pack that includes a ready-to-use breach-notification checklist with a decision tree, an internal incident log template, and pre-written notification letter templates (to the Garante and to affected individuals) — plus a Privacy Policy, Cookie Policy, consent clauses, a full Art. 28 DPA, and a ROPA template. €29 one-time, instant download, editable .docx and .pdf.
See what's included →Not legal advice. This guide is general information, not a substitute for advice from a qualified lawyer or data protection professional about your specific incident — especially while it's active, when you should also consider consulting a lawyer and, for significant incidents, a cybersecurity professional. NormaKit's templates are likewise informational starting points, not legal advice, and should be reviewed and adapted before use.