Data breach and notification duty

In short: A data breach is a security violation leading to loss, alteration or unauthorised access to personal data. It may have to be reported within 72 hours.

In more detail: The controller reports the breach to the supervisory authority unless it is unlikely to result in a risk to the data subjects. For high risk, the data subjects must also be informed.

In Depth

• Examples: stolen laptop, wrongly addressed email with data, hacked database, ransomware, open backup on the internet.
• Process: detect, contain, assess, report, inform those affected, fix causes, document.
• Documentation: Every breach must be documented, even if not reported.
• Preparation: emergency plan, contact persons, logs (observability), backups (3-2-1 rule).
• Fines: High penalties threaten for late or omitted reporting.

See also: Ransomware, BSI-Gesetz