The 72-hour clock for data breaches

What it does

It calculates the 72-hour deadline for notifying ANSPDCP from the moment you enter, shows how much time is left or by how much it has been exceeded, and adds the deadlines for NIS2 entities (DNSC: 24 hours, 72 hours, one month) and for financial entities (DORA). It also reminds you of the obligation to inform the data subjects when the risk to them is high.

What it is based on

• GDPR: Article 33 (notification of the supervisory authority within 72 hours at most of becoming aware, with the reasons for any delay; the internal record of breaches, Article 33(5)) and Article 34 (informing the data subjects when the risk is high).
• NIS2: Article 23 of Directive (EU) 2022/2555, transposed by Government Emergency Ordinance (GEO) no. 155/2024: early warning within 24 hours, notification within 72 hours, final report within one month at most, to DNSC.
• DORA: Article 19 of Regulation (EU) 2022/2554 and the related technical standards: initial notification of major ICT incidents within the first four hours of classification and no later than 24 hours after detection, intermediate report within 72 hours, final report within one month at most.

What to do in the first hours

• Write down the time you found out and who told you; the deadline runs from here.
• Stop the incident from spreading (disconnection, blocking accounts, changing passwords) without destroying the evidence.
• Establish which data, of how many people and with what risk; document the assessment in the incident register, even if you decide not to notify.
• Prepare the notification to ANSPDCP with what you know so far; it can be completed later, in stages.
• If the risk to individuals is high, inform them without undue delay.

Frequently asked questions

When do the 72 hours start?

From the moment the controller "became aware" of the personal data breach (Article 33(1) GDPR), that is, when it has a reasonable degree of certainty that an incident compromising personal data has occurred; not from the moment it happened and not from the end of the investigation.

What do I do if the deadline has passed?

Notify anyway, as soon as possible, and explain the reasons for the delay in the notification; the GDPR expressly requires this. A late, reasoned notification is treated better than no notification at all.

Does every breach have to be notified?

No. Notification is not required when the breach is unlikely to result in a risk to the rights and freedoms of individuals (for example encrypted data, with the key kept safe). The assessment must be documented in the internal incident register, even if you do not notify.

What changes for NIS2 and DORA entities?

Their own deadlines are added: for NIS2, early warning to DNSC within 24 hours, notification within 72 hours and a final report within one month at most; for financial entities, DORA requires the initial notification of major ICT incidents within the first hours of classification, no later than 24 hours after detection.