What to Do After a Data Breach: Immediate Steps and GDPR Notification

The first hours: immediate steps

• Escalate internally: inform IT security, management and the data protection officer.
• End access: lock compromised accounts, revoke sessions and tokens, isolate affected systems.
• Change credentials: renew passwords, API keys and certificates of affected systems, enforce multi-factor authentication.
• Preserve evidence: document logs, timestamps and screenshots before changing systems.
• Determine scope: which data, which people, which time frame?

Notifying the supervisory authority (GDPR Art. 33)

If a personal data breach has occurred, it must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it – unless it is unlikely to result in a risk to the rights and freedoms of natural persons.

Breaches must be documented regardless of whether they are reported (Art. 33(5) GDPR).

Informing affected individuals (Art. 34 GDPR)

If the breach is likely to result in a high risk to individuals, they must be informed without undue delay – in clear language and with advice on what they can do.

Afterwards: fix the cause and learn

• Establish the entry point (phishing, malware, exposed services, a supplier).
• Close gaps, review permissions, adjust training.
• Bring in external help if scope or cause are unclear.

Note

This guide gives a general overview under EU law and does not replace legal or forensic advice for your specific case. Other jurisdictions have their own rules.

Frequently asked questions

Related guides

• How to Check Whether Your Company Has Been Affected by a Data Breach
• Infostealer Logs Explained: How Stolen Credentials Arise and What You Can Do
• Company Credentials Found on the Dark Web? Causes, Risks and Immediate Steps