Emergency · 72 hours
Personal data breach: what applies within 72 hours
The clock starts when you became aware – not when the breach happened. Here is what counts as a breach, when it must be reported, what the notification must contain and which mistakes drive up the cost.
Urgent Book a meeting or email us – we normally reply within one working day.
Need to report today? Get in touch. We go through what happened, do the risk assessment together with you and write the notification – or tell you if it isn't needed.
The basics
What is a personal data breach?
A personal data breach is a security incident that leads to personal data being destroyed, lost, altered or disclosed – or to someone unauthorised gaining access to it. So it is not about intent, but about the effect. Even an internal mistake is a breach.
Typical examples at ordinary companies:
- A mailing where recipients can see each other's email addresses
- The wrong customer received a letter or an invoice with someone else's details
- An employee's email account was hijacked and used to send a mass mailing
- A stolen or lost phone, computer or USB stick
- A system was left open to the internet without protection
- Ransomware or an intrusion where customer data may have been copied
- Personal data remained in a system after it should have been deleted
The timeline
The first 72 hours
The deadlines are linked: notification to the authority within 72 hours, and information to the data subjects without undue delay if the risk is high.
-
0–1 hour – contain
Shut off whatever is leaking, revoke access, change passwords where needed, but delete nothing. Logs and traces are your evidence. Write down what you do and when.
-
1–4 hours – gather the facts
What data, how many people, which categories, how long has it been going on, who can access it now? Contact the supplier if the fault lies with them.
-
4–24 hours – risk assessment and decision
Risk is assessed based on the type of data, the number of people, whether they are particularly vulnerable (children, for example) and how easily the data can be misused. Decide: notify, inform the data subjects, or neither – and document the reasons.
-
24–72 hours – notify IMY
Notification is made through IMY's e-service. You don't need to have the full picture: report what you know and supplement it later. That is both permitted and common.
-
After 72 hours – what then?
If you have missed the deadline: report anyway, and explain why it was late. Reporting late is a smaller problem than not reporting at all.
-
Ongoing – document everything
All breaches must be documented internally, including those that are not reported, with the facts, effects and measures taken. IMY can ask to see that documentation.
The content
What the notification must contain
| Item | How to approach it |
|---|---|
| Nature of the breach | What happened, in plain language. Not which system crashed, but what data was disclosed and how. |
| Categories and numbers | How many data subjects and how many records, estimated if you lack an exact number. Write "approximately". |
| Contact point | Data protection officer or whoever is responsible. One person, directly reachable. |
| Likely consequences | What could happen to the data subjects? Identity theft, fraud, unauthorised access to their information, reputational damage. |
| Measures taken | What you have done and what remains. Planned measures count too. |
Seven mistakes that get expensive
- Waiting for the full picture. The deadlines are strict. Report what you know within 72 hours and supplement later.
- Treating it as an IT matter. IT solves the technology. The questions of notification, risk assessment and information are legal and organisational – and they are yours.
- Cleaning away logs. It hampers the internal investigation and looks bad from the outside.
- Forgetting the supply chain. A subcontractor that leaks must notify you without undue delay. You cannot hide behind the fact that they didn't get in touch.
- Not informing the data subjects. If the risk is high, they must be told without undue delay, and in plain language, what they should do.
- Reporting and then doing nothing. How you handled the breach is what gets examined. The action plan is part of the answer.
- Not documenting the breaches that weren't reported. They are the most common surprise in a supervisory review.
Same event, several deadlines. An attack may require notification to IMY within 72 hours under GDPR, an early warning within 24 hours under the Swedish Cybersecurity Act if you run an essential service, and a police report. Read more about NIS2 reporting and about cyber attacks.
Questions and answers
What we get asked
Is it a breach if no unauthorised person had time to see the data?
Yes, a disclosure can be a breach even if nobody has exploited it. Whether it must be reported depends on the risk to the data subjects.
Do we have to report everything, even small mistakes?
No. Notification is required when the breach is likely to result in a risk to the rights and freedoms of the data subjects. But all breaches must be documented internally – including those that are not reported.
What happens if we report too late?
Report anyway and explain the delay. Reporting late is a mitigating factor compared with not reporting at all.
Should we inform our customers?
If the risk is high: yes, without undue delay and in plain language. If you are unsure, it is better to inform once too often – but do it with facts, not speculation.
Do we have to write the notification ourselves?
You are responsible for it, but you can get help. We write the notification together with you and make sure every point is answered without you promising more than you know.
How long should the documentation be kept?
GDPR sets no explicit period, but the documentation is needed to demonstrate accountability. Assume at least three years, and longer if there are other reasons.
Sources and further reading
- IMY – when should we report the personal data breach?
- IMY – report a personal data breach (e-service)
- EDPB – guidelines on personal data breach notification
Information from authorities changes. Always check the current rules and deadlines with the responsible authority, and take legal advice for legal assessments.
More urgent situations
Other situations we step into
Urgent
Had a breach land in your lap?
We do the risk assessment, write the notification and help you close whatever is still open. Get in touch and we will start with what is known right now.
Urgent Book a meeting or email us – we normally reply within one working day.