Data breach: procedure with the 72-hour deadline
From detection via containment and assessment to notifying the supervisory authority and informing those affected.
ConfidentialitéBase (gratuit)Vérifié le 30.10.2026
Cet article n’est pour l’instant disponible qu’en allemand et en anglais ; nous affichons la version anglaise.
Prérequis
- You are responsible for the incident (incident lead, privacy) or are instructed by them.
- The document is a draft: roles, contact details and the authority are filled in by the operator.
Qui peut le faire ?
This is an operator process, not a feature of the interface. Every staff member reports a suspicion immediately to the incident lead; the incident lead decides on notification together with the data protection officer.
Pas à pas
Detect and report
Sources: monitoring (for example a gap in the audit log, clustered security events), a report from a user, a notice from a processor. Every suspicion goes to the incident lead immediately. A breach also exists when disclosure is accidental.
Record time T0
T0 is awareness, i.e. reasonable certainty. The 72-hour deadline runs from here.
Contain
End all sessions (emergency script, dry run first), renew secrets and credentials, on suspicion of key leakage a new key version and rotation, switch off the affected function, lock the storage area. Preserve evidence and check the audit-log chain.
Assess
Assess the type of data (children, special categories, credentials, messages), volume, identifiability, encryption (keys untouched?), severity and group affected; record the result with reasons.
Notify the supervisory authority
At the latest 72 hours after T0, unless the breach is unlikely to result in a risk; this too is documented with reasons. Information may be supplied later.
Inform organizations and those affected
If club data is affected, the organizations are informed without undue delay (contractually at the latest 24 hours after awareness). With a high risk, those affected are informed without undue delay, for children the guardians.
Document and follow up
Every breach goes into the incident register (also those not reportable), kept outside the application database. Then: cause, measures with a date, adjustment of safeguards, processing register and impact assessment. At least one exercise a year.
Erreurs fréquentes et solutions
- It is unclear whether a duty to notify exists.
- When in doubt, notify; always for children’s data. The assessment is documented with reasons.
- The 72 hours have passed.
- Notify anyway and give reasons for the delay; supply missing details later.
- A processor reports late.
- The contract requires prompt notice; record when awareness arose.
Bon à savoir
- Draft without legal advice: you clarify notification content and risk assessment case by case with the data protection officer and, where needed, legal counsel.
- It remains to be checked whether further notification duties (for example network and information security) also apply.