Purpose
Once a data breach becomes known, a short, strict reporting chain starts: check whether one exists → assess the risk → within 72 hours report to the supervisory authority (if a risk exists) → in the case of a high risk, additionally notify the data subjects → document everything without gaps. This skill guides the controller along this chain, keeps track of the deadlines and drafts notification and communication texts without over- or underestimating the reporting obligation.
Inputs
- Controller (or processor that reports the incident)
- Type of incident (hack, misdirected sending, loss of a data carrier, misconfiguration, insider)
- Affected data categories (master data, payment data, health data, special categories under Art. 9)
- Number of affected persons and data records (estimate permitted)
- Time of becoming aware (start of the 72-hour deadline)
- Immediate measures already taken / containment
- Involvement of a processor
Sub-agent architecture
The skill works in prose steps without a separate agents block. A conceptual three-part division is useful: a facts strand reconstructs the sequence of events, data categories and number of affected persons; a risk strand assesses the risk to the rights and freedoms of the affected persons based on the nature and sensitivity of the data (no / normal / high risk); a deadline and documentation strand monitors the 72-hour deadline, drafts the notification to the supervisory authority and the notification of the data subjects and creates the documentation. The strands are merged into a draft notification.
Process
1. Existence of a data breach (Art. 4 No. 12 GDPR)
A personal data breach exists in the case of destruction, loss, alteration or unauthorized disclosure of or unauthorized access to personal data – whether accidental or unlawful. To be distinguished from mere near-misses without personal data reference. A loss of availability (e.g. ransomware encryption) is also covered.
2. Risk assessment (no / normal / high risk)
The standard is the risk to the rights and freedoms of the affected persons, derived from the nature and sensitivity of the data, number of affected persons, identifiability and possible consequences (identity theft, financial damage, discrimination).
- No risk → no reporting obligation under Art. 33(1), but documentation (step 5).
- Normal risk → notification to the supervisory authority (step 3), no notification of the data subjects.
- High risk → notification and Notification of the data subjects (Step 4).
Payment or health data and a four-digit number of data subjects regularly indicate a high risk.
3. 72-hour notification to the supervisory authority (Art. 33(1) GDPR)
The notification is made without undue delay and, where feasible, within 72 hours after becoming aware – unless the breach is likely not to result in a risk. If the deadline is exceeded, the delay must be justified.
Mandatory content pursuant to Art. 33(3) GDPR:
a) nature of the breach, where possible with categories and approximate number of data subjects concerned and records concerned b) name and contact details of the data protection officer or other contact point c) likely consequences of the breach d) measures taken or proposed to address and mitigate the breach
If not all information is available, pursuant to Art. 33(4) GDPR a phased (gradually supplemented) notification is permissible – the deadline must not be awaited until all details are clarified.
4. Notification of the data subjects (Art. 34(1) GDPR)
In the case of a likely high risk the data subjects must be notified without undue delay in clear and plain language; in terms of content at least the information from Art. 33(3)(b)–(d).
Exceptions under Art. 34(3) GDPR – notification not required if:
- the data are rendered inaccessible to unauthorized persons by suitable technical measures (in particular encryption),
- subsequent measures have averted the high risk in all likelihood, or
- the notification would involve disproportionate effort (then public communication).
5. Documentation (Art. 33(5) GDPR)
All data breaches must be documented – including those not subject to notification. The facts relating to the breach, its effects and the remedial measures taken must be recorded. This documentation obligation serves the supervisory authority's ability to verify (accountability).
6. Immediate measures / containment
In parallel with the notification: isolate affected systems, reset access credentials, close the security gap, secure forensic evidence. These measures are included as "measures taken" in Art. 33(3)(d) and, where applicable, in the exception under Art. 34(3).
7. Deadline check
- Start of the deadline: time of the controller's becoming aware – not merely the time of the incident.
- If a processornotifies, the controller's 72-hour deadline begins with its being informed (Art. 33(2)).
- The 72 hours run by calendar (incl. weekend/public holiday) – a malfunction that becomes known on Friday evening must be reported regularly by Monday evening.
Output format
DATENPANNE – Meldeentwurf — <Verantwortlicher> — <Datum>
0. Sachverhalt <Hergang, Datenkategorien, Zahl Betroffener>
1. Vorliegen Art. 4 Nr. 12 [✅ Datenpanne / ❌ kein Personenbezug]
2. Risikobewertung [kein / normales / hohes Risiko] Begründung: <…>
3. Meldung Aufsichtsbehörde (Art. 33)
Kenntniserlangung: <Datum, Uhrzeit>
Fristende (+72 Std.): <Datum, Uhrzeit>
a) Art der Verletzung <…>
b) Kontaktstelle / DSB <…>
c) wahrscheinliche Folgen<…>
d) ergriffene Maßnahmen <…>
Phasenweise (Abs. 4)? [ja / nein]
4. Benachrichtigung Betroffene (Art. 34)
Erforderlich? [ja – hohes Risiko / nein]
Ausnahme Abs. 3? [Verschlüsselung / Risiko abgewendet / Aufwand]
Entwurf: <…>
5. Dokumentation (Art. 33 Abs. 5) Ablage: <…>
Empfehlung: <…>
Decision tree:
Datenpanne (Art. 4 Nr. 12)?
└─ nein → keine Meldung, ggf. interne Notiz
└─ ja → Risiko für Rechte/Freiheiten?
├─ kein Risiko → keine Meldung, NUR Dokumentation (Art. 33 Abs. 5)
├─ normales Risiko→ Meldung Aufsichtsbehörde (Art. 33) + Dokumentation
└─ hohes Risiko → Meldung (Art. 33) + Benachrichtigung (Art. 34) + Dokumentation
└─ Ausnahme Art. 34 Abs. 3? → Benachrichtigung entbehrlich
Risks / typical mistakes
- 72-hour deadline missed because complete clarification is awaited → instead report in phases (Art. 33(4)).
- high risk misjudged → failure to notify the data subjects (Art. 34) → separate infringement.
- Documentation obligation (Art. 33(5)) overlooked, even if no report is made → lack of demonstrability vis-à-vis the supervisory authority.
- Deadline start incorrectly set (incident instead of knowledge acquisition).
- Fine under Art. 83(4) GDPR for infringement of the reporting, notification or documentation obligations of Art. 33/34 (up to EUR 10 million or 2% of worldwide annual turnover).
Sources
Statute
- Art. 4(12) GDPR (definition)
- Art. 33 GDPR (report to the supervisory authority)
- Art. 34 GDPR (notification of the data subjects)
- Art. 83(4) GDPR (fine)