Personal Data Breaches Under GDPR: Assess, Notify, Recover
How to recognise a personal data breach, assess the risk to people, notify IMY within 72 hours and decide when to tell the people affected.
Explore the GDPR Guide
Eleven chapters, each one readable on its own. Most include a tool you can use as you read.
What counts as a personal data breach
A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without authority.
Confidentiality, integrity and availability breaches
Breaches fall into three types, and one incident can be more than one.
Assessing risk to individuals
The risk to the people affected decides whether you must notify IMY and the individuals.
Notifying IMY within 72 hours
Breaches likely to result in a risk to people must be reported to IMY within 72 hours of becoming aware.
When you must tell the people affected
If the breach is likely to result in a high risk, you must also inform the people affected without undue delay.
Processors, controllers and who reports
Controllers report to IMY. Processors must tell the controller without undue delay.
Documenting every breach in your register
All breaches must be documented, including those you decide not to report.
Common breach scenarios and how to handle them
Most breaches follow a few familiar patterns.
Breaches involving a ransomware attack
Ransomware is usually a personal data breach, especially when data was stolen.
Coordinating GDPR with NIS2 reporting
One incident can trigger both GDPR and NIS2 reports, to different authorities on different clocks.
Reducing the chance of the next breach
Each breach shows where controls or routines can improve.
Check Your Breach Readiness
Review your breach routine against GDPR Articles 33 and 34 and get the checklist in your inbox.
- Detection: Recognise a breach and start the clock. Chapters 1 to 2
- Assessment: Assess the risk to the people affected. Chapter 3
- Notification: Notify IMY within 72 hours. Chapters 4 to 5
- Records: Log every breach, reported or not. Chapter 7
Get Your Free GDPR Gap Checklist
Delivered to your inbox instantly.
No spam. EU data residency. Unsubscribe any time.
Get a 30-Minute Security Briefing.
No Pitch Deck.
Talk to a Sweden-based analyst. We'll review your posture, map your gaps and give you a clear picture of where you stand, in plain language.
Book a Free Briefing