Contract Law2026-10-16

Data Breach Discovered at Your Business – What Must I Do in the First 72 Hours?

An employee has sent customer data to the wrong distribution list, or a laptop has gone missing: what you, as a managing director, must now assess, report and document within 72 hours – and which mistakes lead to fines and damages claims.

The email with all your customer addresses has gone to an open distribution list. Someone has stolen the company laptop with the staff list from a car. Or a ransomware trojan has eaten its way through your network. In moments like these, every hour counts – not only technically, but legally. As a managing director or business owner, the responsibility for taking the right steps now rests with you. This very question – what to do within 72 hours – is the one I hear most often from businesses in the region. And the deadline itself is the biggest trap.

In short

As a rule, you must report a personal data breach to the competent supervisory authority within 72 hours of becoming aware of it. This duty falls away only where a risk to the rights and freedoms of the data subjects is unlikely. In addition, you must notify the affected individuals directly where the breach is likely to result in a high risk. And even if you ultimately conclude that no report is required, you must document the incident in every case. That obligation never falls away.

How I can help you

Assessing the risk within the first few hours: whether a reporting duty arises at all, and to whom the report must be made
Drafting and submitting the report to the Bavarian State Office for Data Protection Supervision (BayLDA) on time
Checking whether the affected individuals must also be notified, and drafting that notification
Building documentation that will stand up to a later inspection by the supervisory authority
Representing you before the supervisory authority in any follow-up questions, hearings or fine proceedings
Clarifying your liability towards customers and business partners, and your position in relation to any service providers you use (processors)

When a reporting duty actually arises

Not every incident is reportable. What matters is whether the breach is likely to result in a risk to the rights and freedoms of the affected individuals. The report to the authority falls away only where that risk is unlikely. The burden of proof here lies with you as the controller, not with the authority.

An example: an internal email is sent by mistake to the wrong but trustworthy colleague within the company. You will routinely assess that case differently from the same error with an external, unknown recipient. Likewise, you will assess an encrypted and properly secured laptop differently from one giving open access to the customer database. What matters includes the nature of the data involved, the number of people affected, and whether the data actually fell into the wrong hands or merely could have done. Health data, financial data and children’s data carry more weight here than simple contact details. This assessment is yours to make. When in doubt, set out your reasoning in writing – even if you ultimately decide against a report.

The 72-hour deadline: start, end and follow-up reports

The deadline does not begin with the incident itself, but with your company becoming aware of it. What matters is the moment at which a responsible person in the business knows, with sufficient certainty, that a data protection breach has occurred. A vague suspicion is usually not yet enough. A reasoned conclusion that something has in fact happened, however, is. Some people look the other way, or set up unclear internal reporting lines. An incident then only comes to light days later. That does not push back the start of the deadline.

Where an employee or an external service provider informs you as the controller of the incident, the deadline runs from that point. It is not the personal briefing of management that counts. If you yourself engage a processor – say an IT service provider handling your customer data – that provider must inform you without undue delay of any breach. The 72-hour deadline towards the authority nonetheless, as a rule, still rests with you as the controller.

Within the 72 hours you do not already have to have clarified every detail. Where not all of the required information can yet be obtained, you may provide it in stages. This must not, however, cause any further undue delay. If you exceed the 72-hour deadline overall, attach to the report an explanation for the delay. A report without that explanation looks considerably worse to the authority than a timely but still incomplete report with further information announced to follow.

When you must also inform the affected individuals

Reporting to the authority is one duty. Notifying the affected individuals themselves – your customers or employees, for example – is a second, stricter duty with a higher threshold. It applies where the breach is likely to result in a high risk to the rights and freedoms of those affected. You then inform them without undue delay, in clear and plain language. Say what has happened and what measures you have taken.

This notification exceptionally falls away in three situations. First: you had protected the data by technical measures – effective encryption, for example – so that unauthorised persons can do nothing with it. Second: you have, in all likelihood, already eliminated the high risk through subsequent measures. Third: individual notification would involve disproportionate effort. In that third case, a public communication that informs just as effectively takes its place. Conversely, the supervisory authority can also require you to notify. That applies where you yourself do not consider notification necessary but the authority assesses the situation differently.

Documentation, fines and liability

Regardless of whether you ultimately report or not, you must document every data protection breach – with the underlying facts, its effects and the remedial measures taken. This documentation is your proof towards the supervisory authority. It shows that your decision – to report or not, to inform those affected or not – rested on a reasoned risk assessment, not on chance or carelessness.

If the report is omitted entirely although it would have been required, that can trigger fine proceedings. The same applies if you provide it late without a comprehensible explanation. The framework and the criteria for setting any fine follow the relevant provisions of the General Data Protection Regulation. Alongside this stands the civil-law side: affected individuals can claim damages where the breach has caused them material or non-material harm. Under the current legal position, even the mere, tangible loss of control over one’s own data can suffice as non-material harm. Those affected do not have to prove any concrete misuse of the data for this. That significantly increases the commercial risk, for you as a business, of a badly handled data breach.

A typical case from practice

The accounts department of a mid-sized trades business sends an Excel spreadsheet containing the names, addresses and bank details of around 200 customers to a wrongly selected group distribution list. That list also includes third parties outside the company. The mistake is spotted the same afternoon. Management calls me straight away: do I have to report this, and if so, how do I word it without incriminating myself? I assess the data – bank details are sensitive enough to give rise to a risk – and calculate the deadline from the moment of discovery. I draft the report to the BayLDA, framing the detail still missing as a follow-up report that has been announced. In parallel, I clarify whether and how the affected customers must be informed. I build the entire documentation so that it holds up. Even months later, it still shows why I made each decision.

Common mistakes

Some only count the deadline from the decision “this is probably reportable”, rather than from the actual moment of becoming aware. By then you are often already too late.
Some document nothing at all, because they have decided – rightly or wrongly – against a report. But the documentation obligation exists regardless.
Some drag out the report for fear of self-incrimination, until every detail is clarified, instead of reporting on time with further information announced to follow.
Processors report incidents to the controller too late or not at all, because the contractual reporting duty was not regulated clearly enough.
Some decline to inform affected individuals across the board, out of concern for reputational damage. Where the risk is high, however, there is a legal duty to do so, and keeping quiet tends to increase the liability risk rather than reduce it.

Frequently asked questions

Do I really have to report every small incident?

No. Only what is likely to bring a risk to the rights and freedoms of those affected is reportable. An internal misdelivery without access by unauthorised persons may, in the end, be assessed differently from the same error with external recipients. Document the assessment all the same, even where it ultimately reads “no report required”.

To whom do I report a data breach in Bavaria?

In Bavaria, the competent body for non-public entities such as businesses is the Bavarian State Office for Data Protection Supervision (BayLDA). The report is made through the channels the authority has provided for that purpose.

What if I cannot meet the 72-hour deadline?

Report anyway, as early as possible, with the information you already have, and provide the rest in stages. If you exceed the deadline, attach an explanation for the delay to the report. A late report with a comprehensible explanation stands considerably better than one without.

Can my IT service provider be liable for the incident?

Where the provider has processed data for you as a processor, they are under a duty: they must inform you without undue delay of any breach that has occurred on their side. The duty to report to the supervisory authority nonetheless, as a rule, rests with you as the controller. Whether and to what extent the provider is liable to you depends on your contract with them.

Is it enough if I only document the incident internally?

The report to the authority falls away only where, after careful assessment, there genuinely is no risk. The documentation obligation remains untouched by this and exists in every case. If that documentation is later missing during an inspection, it works against you – even where the decision against a report was substantively correct.

Your next step

If you have just discovered a data breach in your business, every hour now counts for the risk assessment and the calculation of the deadline. Do not wait until every detail is clarified. Call me before you decide internally that “it probably won’t be that bad”. I will assess the risk together with you, draft the report to the supervisory authority on time, and build the documentation so that it holds up in any later inspection. Data protection questions in businesses are routinely closely interwoven with contractual duties towards customers and service providers. More on this in the Contract Law area.

This article provides general information and is no substitute for legal advice in an individual case. Last updated: 2026-10-16.

This article was written by Christian Czirnich, a German Rechtsanwalt (lawyer) since 1994, Kirchseeon (district of Ebersberg). He advises consumers, online retailers and small and medium-sized businesses in contract and business law, with clients from the district of Ebersberg, east Munich and the Rosenheim area, in English or German and by video on request.

Christian Czirnich, Rechtsanwalt (attorney at law), Kirchseeon near Munich

Tell me what happened and when you discovered it – I will take a look.

I read every message myself and usually reply on the next working day. What you write to me is covered by legal professional privilege from the first word, even if no engagement comes about. The initial assessment is free of charge.