Personal Data Breach: What a Small Business Must Do Within 72 Hours

A personal data breach can take very mundane forms: a laptop containing a customer file stolen from a car, an email mistakenly sent to the wrong recipient list, a misconfigured WordPress plugin that leaves a database publicly accessible. In each of these cases, the General Data Protection Regulation imposes precise obligations, with tight deadlines that many small businesses only discover the moment the incident happens.

What the GDPR calls a breach

A data breach, under Article 33 of the GDPR, refers to any security incident leading accidentally or unlawfully to the destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, personal data. This broad definition covers both a cyberattack and a simple human error, such as a newsletter email sent with recipients visible in the cc field rather than hidden in bcc, exposing every recipient's address to all the others.

The 72 hour countdown

When the breach is likely to result in a risk to the rights and freedoms of the individuals concerned, the business responsible for the processing must notify the incident to the relevant supervisory authority without undue delay, and where feasible, within seventy two hours of becoming aware of it. This deadline does not start when the technical incident occurs, but when the business gains reasonably certain knowledge of it, which can create ambiguity when the discovery itself unfolds gradually. The notification can be made in stages: an initial declaration within seventy two hours, even incomplete, followed by further information as the investigation progresses, rather than waiting for a full analysis before any declaration.

Not every breach is handled the same way

The expected response depends on the assessed level of risk to the individuals concerned. A breach judged to pose no plausible risk to individuals, for example an encrypted file lost with no accessible decryption key, should simply be logged in an internal breach register, with no notification to the supervisory authority. A breach presenting a risk must additionally be notified within the seventy two hour deadline. A breach presenting a high risk, for example the exposure of banking data or health data, additionally requires individually informing each affected person without undue delay.

What the notification must contain

The notification to the supervisory authority, submitted through its dedicated online service, must describe the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences of the incident, as well as the measures already taken or planned to address it and limit its effects. A late notification remains possible but must then be accompanied by reasons justifying the delay, which does not remove the obligation but may potentially soften the consequences if the delay is justified.

Why small businesses are particularly exposed

Small businesses account for a significant share of breaches reported each year in France, often because they have more limited security resources than a large company, without being exempt from the same legal obligations. A WordPress site with an outdated plugin, a weak admin password, or an external provider poorly bound by contract, are frequent entry points for this type of incident among freelancers and small businesses.

Preparing before the incident happens

Keeping a data processing register up to date, documenting the security measures in place, and preparing a notification template in advance make it possible to react faster the day an incident actually occurs, rather than discovering the procedure in an emergency. For a small business with no in house data protection officer, identifying in advance a legal or technical contact able to support this process avoids wasting precious time on a deadline measured in hours rather than days.

Points to verify before publishing: confirm that the seventy two hour deadline and the three risk levels described in this article still match the current wording of Articles 33 and 34 of the GDPR at the time of publication, and check that the address of the supervisory authority's notification portal remains accurate and accessible.