Data breaches and notification duties

Article 4(12) GDPR defines a personal data breach as a breach of security leading to accidental or unlawful destruction, loss or alteration of personal data. Unauthorised disclosure or access is also covered.

A message sent to the wrong recipient therefore requires assessment just as a cyberattack does. A file may have been exposed only briefly and a cloud account may have been open only for a short period. Whether a notification duty exists is a separate question.

The process is not limited to digital systems. A lost paper file, an exposed printout or a letter sent to the wrong address can trigger the same assessment. The relevant point is the concrete risk to the people described by the data.

The time of awareness is a central reference point. Record when a person in the business first learned facts that made a breach likely. A vague suspicion without concrete indications must be distinguished from that point. Once the relevant information exists the assessment process should begin.

Immediate measures should limit further harm. They may include disabling an account, recalling a message, isolating a system or preserving logs. Technical actions should be linked to a legal timeline so a later review can show what was known and why each step was taken.

A responsible person should coordinate the response. If a processor is involved it must inform the controller without undue delay. The roles and workflows for service providers should therefore be clear in the agreement and the incident process.

A rule that every breach must be reported is incorrect. Article 33 GDPR links authority notification to the likelihood of a risk for the rights and freedoms of individuals. The number of records is not the only factor. Sensitive content can be significant even when only a few people are affected. A large dataset protected by effective encryption may be assessed differently.

Consider the type and scope of the data, the number and group of affected people and the possible consequences. Ask whether contact data could support fraud, whether health information or financial details are involved and whether a recipient could actually read the data. The duration of access and the safeguards in place also matter.

The decision should include a reasoned explanation. The business does not have to prove every possible consequence. It should be able to show which facts were considered and why a risk was accepted or rejected. The data breach initial check helps structure these questions.

Where a risk is likely the controller must notify the competent supervisory authority without undue delay. Where feasible the notification should be made no later than 72 hours after awareness. If the period is exceeded the delay must be explained. The period is therefore not a reason to wait for the forensic investigation to finish.

An initial notification can be based on the secured interim position. Missing information can be supplied later. Article 33(3) GDPR refers to the nature of the breach, the categories and approximate number of affected people and records, likely consequences and measures taken or proposed. A contact point must also be provided.

Whether the Austrian authority is competent depends on the establishment, the processing and the applicable allocation of responsibilities. Use the procedure provided by the competent authority. An internal note saying “reported” is not a sufficient record. Keep the submitted version and later supplements together.

Communication under Article 34 GDPR is distinct from authority notification. It generally applies where the breach is likely to result in a high risk to the rights and freedoms of individuals. In that case affected people must be informed without undue delay in clear and plain language.

Communication may not be required where effective technical and organisational measures have made the high risk unlikely. Subsequent measures may also matter if they mean that the high risk is no longer likely. The reasons belong in the incident record.

The message should explain the incident, the contact point, likely consequences and measures already taken. If direct communication would involve disproportionate effort a public communication may be required. The appropriate form depends on the incident and the people affected.

Article 33(5) GDPR requires the controller to document every personal data breach. This applies even when the risk assessment concludes that authority notification is not required. The record should contain the facts, effects and remedial measures and allow the authority to verify compliance.

A consistent incident file can contain the timeline, affected systems, data categories, recipients, safeguards, assessment and approvals. Update it when new information arrives. An incident register is not a substitute for an individual assessment. It should make decisions traceable and expose recurring weaknesses.

The privacy governance framework should assign responsibility for containment, legal approval and communication with processors and individuals. The data breach checklist supports the first internal record.

Problems often arise from unclear responsibility and an incomplete timeline rather than from a lack of technical knowledge. The incident process should address these points explicitly.

A business can reduce response time when essential information is easy to find during normal operations. Useful materials include current contact routes, role descriptions, processor lists and a process for preserving technical logs. Preparation should match the size and risk of the processing.

For a specific breach record the affected systems, data fields, recipients, access period, safeguards and communication steps. Also preserve the decision explaining why a notification was or was not required. This turns a rushed response into a reviewable process.

A breach may reveal a structural weakness. After the urgent response review access rights, training, retention concepts and processor agreements. The data breach checklist supports a shared internal vocabulary.