Security incidents and personal data breaches represent some of the most critical commercial exposures facing businesses in the digital economy. Whether arising from an accidentally misaddressed email circulation list, the theft of unencrypted mobile hardware or an advanced ransomware attack encrypting internal corporate servers: once personal data is compromised, corporate leadership faces an immediate ticking clock. Alongside technical containment, management must take far-reaching legal decisions under severe time pressure, where flawed execution can trigger substantial regulatory fines.
In this interview, Felix Wenzel, associate in IT and data protection law at Hallström Ostermeyer, outlines how businesses should manage data protection incidents and what preparations provide an essential operational advantage in an emergency.
- Data breaches must be notified to the competent supervisory authority within 72 hours.
- Notification duties do not arise automatically, but require a documented risk assessment.
- Affected individuals must be informed without undue delay where high personal risk exists.
- Structured incident response frameworks reduce procedural missteps during regulatory reviews.
The critical hours following discovery
Mr Wenzel, what is the most frequent error businesses commit immediately following a security incident?
The most damaging mistake is hesitation. Internal IT teams often spend days attempting to ascertain the technical scope of an intrusion independently before notifying management or legal counsel. Under the General Data Protection Regulation, however, the statutory window for notifying supervisory authorities begins the moment the organisation attains reasonable certainty that an incident has taken place. If initial days pass unutilised, meeting the statutory 72-hour notification window becomes almost impossible.
Conversely, hasty panic poses equal risks. Submitting an unverified notification lacking baseline facts generates confusion and draws regulatory scrutiny prematurely, even where subsequent technical audits show the incident was benign.
The priority is immediate, structured activation of an incident response team comprising IT, leadership, corporate communications and legal advisers.
The statutory 72-hour notification requirement
When exactly must a notification be made to the data protection authority, and what information must it contain?
As a general principle, every breach of personal data security must be notified, unless the incident is unlikely to result in a risk to the rights and freedoms of natural persons. This risk assessment must be executed rigorously and recorded in writing. Where a risk is identified, the notification must reach the competent regional data protection authority within 72 hours.
Many corporate officers are unaware that notifications can be submitted on a phased basis. European privacy rules explicitly permit providing an initial notification containing established preliminary facts, followed by detailed forensic analyses and confirmed numbers of affected records in subsequent submissions.
The statute requires a description of the nature of the breach including the data categories concerned, its likely consequences, the measures taken or proposed and the contact details of the Data Protection Officer.
These figures illustrate key parameters governing statutory notification regimes under Article 33 GDPR. The timing trigger and substantive depth depend on contemporary facts and breach severity.
Notifying affected data subjects
When must customers, contractors or employees be informed directly alongside public authorities?
Notifying affected data subjects under Article 34 GDPR is mandatory only where a personal data breach is likely to result in a high risk to personal rights and freedoms. This applies where unencrypted passwords, financial records, medical files or government identification credentials have been exfiltrated, or where identity theft is a tangible threat.
Where compromised records were encrypted using state-of-the-art standards and cryptographic keys remain secure, individual communication duties generally do not arise.
Accessible communication and practical recommendations
Where individual notifications become necessary, communications must be composed in clear and plain language. Convoluted legal prose and technical jargon undermine statutory objectives.
The communication must outline clearly what risks exist and what defensive steps individuals should undertake, such as resetting credentials or reviewing financial statements.
Engaging with supervisory authorities
How do data protection regulators respond upon receiving a breach notice, and how should enterprises interact with them?
Supervisory authorities almost invariably demand supplementary written submissions and technical audit documentation. They examine not merely the mechanics of the intrusion, but crucially whether the enterprise maintained appropriate technical and organisational measures prior to the breach.
Transparent and methodically documented post-incident engagement protects businesses against escalating regulatory penalties.
Enterprises should cooperate with regulators constructively and transparently. Inconsistent statements or attempts to downplay deficiencies invite deeper investigations and increase the risk of administrative penalties.
Every investigative phase, notification deliberation and forensic audit report must be logged meticulously within the internal breach register.
Preparation protects in a crisis
What preparatory measures should businesses take before an incident occurs?
Attempting to allocate responsibilities or locate templates for authority notifications during an active crisis costs valuable time. Every enterprise must maintain an updated incident response playbook.
Conducting routine simulation exercises helps all designated participants understand their operational assignments and act with coordination under regulatory pressure.
Note: General information, not legal advice. Demo content.