Data breach risk check
Four questions about your incident, a first view of the fine risk and the duties that are now running, above all the 72-hour deadline for notifying the supervisory authority.
Your answers never leave your browser. We do not transmit or store them, and no session recording runs on this page.
What happened?
For orientation only, not legal advice. Whether a fine is imposed, and how high, is decided by the supervisory authority case by case.
The 72-hour rule
The deadline is short, and it often runs before all the facts are known.
When it starts
When you, as controller, become aware of the breach. A processor must in turn inform you without undue delay (Art. 33 (2)).
How it is counted
In hours, not working days. Weekends and public holidays do not stop the clock (Art. 3 (3) of Regulation (EEC, Euratom) No 1182/71 on time limits).
If not everything is known yet
Notify on time anyway. You may provide missing information in phases without undue further delay (Art. 33 (4)).
If the deadline has passed
Notify immediately and give reasons for the delay (Art. 33 (1) sentence 2). A late notification is better than none.
What applies now
Three provisions of the GDPR determine what to do after a data breach and what a failure can cost.
Notifying the supervisory authority
- The controller notifies the breach without undue delay and, where feasible, within 72 hours of becoming aware of it.
- Notification is only unnecessary if the breach is unlikely to result in a risk to the people affected.
- Every breach must be documented regardless, with the facts, its effects and the remedial action taken (para. 5).
Informing the people affected
- If the breach is likely to result in a high risk to the people affected, they must also be informed without undue delay.
- This is not required, for example, if the data was effectively encrypted or follow-up measures mean the high risk is no longer likely to materialise.
Fines
- Breaches of the notification duties can be fined up to EUR 10 million or 2 % of worldwide annual turnover, whichever is higher (para. 4).
- The amount depends on factors including the nature, gravity and duration of the infringement, the categories of data, cooperation with the authority and whether the breach was notified (para. 2).
Rather look at it together?
In an initial consultation we assess your incident, check the notification duties and help with the report to the supervisory authority. At short notice too, if the clock is running.
This check gives a first orientation and is not legal advice. The fine ranges are rough experience values, not a forecast for your case.