Do we have to report a ransomware attack under the GDPR?
Often yes, if personal data was affected, even when nothing was stolen. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). defines a personal data breach in Article 4(12) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Encryption by ransomware makes personal data unavailable, which is a breach of availability, and attackers often copy data before encrypting. Under Article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people, for example because a recent backup restored everything quickly and nothing left the network. Document the reasoning either way. NetSenX can show whether unusual uploads left monitored devices before the encryption, which matters for that assessment.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- If the stolen data was encrypted, must we still notify?
- We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?
- When does the GDPR 72-hour notification clock start?
- One incident, several reports: how do NIS2, the GDPR and DORA fit together?
- What is a major ICT-related incident under DORA?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
← All 35 questions on Incident reporting deadlinesAll topics