Personal data breach: the 72 hours start when an employee notices

In brief

A personal data breach is an event in which personal data is destroyed, lost, altered or ends up in someone's hands without authorisation. The General Data Protection Regulation obliges the controller to notify the supervisory authority, in Finland the Data Protection Ombudsman, without undue delay and where feasible within 72 hours of the breach coming to light. The clock starts when the organisation becomes aware of the breach, and in practice that is the moment an employee notices it and passes it on. The 72-hour deadline is therefore everyone's business, even though the controller files the notification.

What is a breach and what is not

The word breach makes people think of an attack. Most breaches are not one. An email with a customer's details goes to the wrong recipient. A payroll list is shared to a folder the whole organisation can see. A laptop is left on a train. A paper patient list ends up in general waste. Each of these is a personal data breach, because the data could have reached someone with no right to it.

A breach does not require that anyone has misused the data. It is enough that it was possible. On the other hand a security incident without personal data, such as a denial-of-service attack on a website, is not a personal data breach in the GDPR's sense, even though it may be a reportable incident under the Finnish Cybersecurity Act. Drawing that line is the work of the data protection officer and the information security officer, discussed further below.

72 hours, and when they start

Article 33(1) of the GDPR says the controller shall notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Two things here are easy to miss. First, the deadline runs from becoming aware, not from when the breach happened. An organisation that discovers a months-old leak today is on schedule today. Second, awareness means the organisation's awareness, and an organisation knows what its employees tell it. An employee who notices a mistake on Friday and mentions it on Monday has used up most of the deadline before anyone has assessed anything.

That is why the core of staff training is not 72 hours but at once. Our skills catalogue describes level 2 like this: reports without delay through the right route, does not try to fix the situation quietly and does not delete evidence. Recognising the situation and reporting fast is every employee's share. Assessing the risk, drafting the notification and deciding whether to inform the data subjects is the controller's share.

What goes into the notification

Paragraph 3 of the article lists the minimum content. The notification must describe the breach including, where possible, the categories and approximate numbers of data subjects and of personal data records concerned, give the contact details of the data protection officer or another contact point, describe the likely consequences of the breach, and describe the measures taken or proposed, including measures to mitigate adverse effects.

Where not everything is known within 72 hours, paragraph 4 allows the information to be provided in phases without undue further delay. The notification should therefore not be held back because the investigation is unfinished. The first notification says what is known, and it is supplemented.

Step	Who	What
Discovery	Employee	Reports at once through the organisation's route, deletes no evidence
First assessment	Data protection officer or named responsible person	Scopes which data and which people are affected, starts the record
Risk assessment	Controller	Is there a risk; if not, the reasoning is recorded
Notification to the authority	Controller	To the Data Protection Ombudsman within 72 hours of becoming aware, in phases if needed
Notification to data subjects	Controller	If the risk is high, without undue delay, in clear language
Documentation	Controller	Every breach, including those not notified

When the people are told too

Article 34 concerns informing the data subjects, the people whose data the breach concerned. They must be informed without undue delay when the breach is likely to result in a high risk to their rights and freedoms. The communication describes in clear and plain language the nature of the breach and gives at least a contact point, the likely consequences and the measures taken.

Informing data subjects is not required if the data was protected so that it is unintelligible to outsiders, for example encrypted; if the controller has taken subsequent measures ensuring the high risk is no longer likely to materialise; or if individual communication would involve disproportionate effort, in which case a public communication is used instead. The supervisory authority may also require the controller to inform the data subjects if it has not done so.

This is where it shows why the risk assessment belongs to the controller and not to the employee. The same event, a lost laptop, is a different matter with an encrypted and an unencrypted disk, and that is decided by whoever knows the safeguards.

When the same event is also a Cybersecurity Act incident

For an entity within the scope of the Finnish Cybersecurity Act (124/2025), the same ransomware attack can be both a personal data breach and a significant incident to be reported to the sector's supervisory authority under the Cybersecurity Act on its own deadlines: an early warning in 24 hours, an update in 72 hours and a final report within a month. Two notifications, two authorities, two different clocks. The Cybersecurity Act's reporting chain is covered in What must be reported about a security incident, and when?.

Drawing the line is level 4 competence in our skills catalogue: leads the investigation, drafts the notifications to the authorities and recognises when the same event requires notifying both the Data Protection Ombudsman and the sector's supervisory authority under the Cybersecurity Act. It belongs to the data protection officer and the information security officer, whose competence is described in When must a data protection officer be appointed and What must an information security officer know.

What the law does not require

The law does not require that every breach is notified to the authority. It requires that every breach is documented and assessed, and that notification is omitted only with reasons. Nor does the law require the notification to be complete at the 72-hour mark; it may be supplemented. And the law does not require a risk assessment from the employee: from the employee it requires recognising the situation and telling someone at once.

That is the part taught to all staff, and it fits in six minutes. The Data Protection Basics as a whole, of which recognising breaches is one of four skills, is described in What data protection competence is required of every employee?.