When must we tell the affected people about a data breach?

When the breach is likely to result in a high risk to their rights and freedoms. Article 34 of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). then requires the controller to communicate it to them without undue delay, in clear and plain language, describing the nature of the breach, the likely consequences, the measures taken or proposed and the contact of the data protection officer. High risk typically means data that can cause real harm, such as identity documents, bank or health data, passwords, or information that enables fraud. Article 34(3) lists exceptions: the data was made unintelligible, for example by strong encryption; later measures mean the high risk is no longer likely; or individual messages would take disproportionate effort, in which case a public communication is used instead. The supervisory authority can also require you to inform people. Tell them what to do, such as changing passwords or watching for phishing.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics