Data Breach Incident Management

Data breach? Now every hour counts.

Data breach? Call us. Assessment, notification, documentation.

What we deliver

From obligation to advantage.

In the event of a data breach we handle risk assessment, timely notification to the supervisory authority, communication with affected individuals and audit-proof documentation, with raised priority for our clients.

  • Risk assessment
  • Timely notification to the supervisory authority (Art. 33 GDPR)
  • Communication with affected individuals (Art. 34 GDPR)
  • Communication with authorities and clients
  • Consulting during technical and forensic remediation
  • Audit-proof documentation and root-cause analysis

Immediate help

First aid for data protection incidents.

The 72-hour deadline under Art. 33 GDPR starts the moment you become aware of the incident. Take these five steps straight away, before you even reach us. They cost a few minutes and later decide whether the incident can be documented cleanly.

  1. Isolate the affected systems, but do not switch them off and do not delete anything. Traces are evidence.
  2. Secure logs and screenshots, including any extortion emails.
  3. Note the time and circumstances of becoming aware. The 72-hour deadline hangs on it.
  4. Do not yet inform data subjects, customers or the press.
  5. Keep a written record of who did what and when.

Then call us: +49 (0)69 27 13 57 20-0. A member of staff answers, not a hotline. Outside office hours send us an email to info@datenschutzfrankfurt.de with the keyword „data breach“ in the subject line and your phone number, or use our contact form. We will get back to you as quickly as possible.

How we work

Four steps to your goal.

  1. Step 01

    Initial assessment

    You report the incident; within a few hours we assess the risk to those affected and the notification duty under Art. 33 GDPR.

  2. Step 02

    Notification to the authority

    Where notification is required, we handle it within 72 hours under Art. 33 GDPR.

  3. Step 03

    Informing those affected

    Where there is a high risk to those affected, we also inform them under Art. 34 GDPR.

  4. Step 04

    Documentation & follow-up

    Audit-proof documentation of the incident, root-cause analysis and immediate and follow-up measures to prevent recurrence.

Data breach

72 hours that count.

When a data breach occurs, the clock is running: notification to the supervisory authority is mandatory within 72 hours of becoming aware (Art. 33 GDPR). Anyone who only then starts clarifying responsibilities loses valuable time. For clients in Frankfurt am Main and the Rhine-Main region we can also be on site at short notice when it counts.

What counts as a notifiable breach

A "personal data breach" (Art. 4(12) GDPR) is any destruction, loss or alteration, and any unauthorised disclosure of or access to personal data, whether through a hacking attack, a lost laptop or a mis-addressed email.

The deadlines at a glance

  • Notification to the supervisory authority within 72 hours (Art. 33 GDPR)
  • Communication to affected individuals without undue delay where the risk is high (Art. 34 GDPR)
  • Documentation of all incidents, including non-notifiable ones

What we take on

Risk assessment within a few hours, timely notification, communication with the authority and affected individuals, and audit-proof documentation and root-cause analysis, with raised priority for our clients.

More services

What else we cover.

From the blog

Further reading on the topic.

Need advice on data protection?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What gets asked first in an emergency.

Does every data breach have to be reported?
No, only if there is a risk to the rights and freedoms of the affected individuals. We assess the risk case by case and document the decision against notification too, as required by Art. 33(5) GDPR.
How fast must a breach be reported?
Within 72 hours of becoming aware, if there is a risk. If there is a high risk to those affected, notifying them without undue delay under Art. 34 GDPR is additionally required.
What if the incident happens outside office hours?
Outside office hours send us an email to info@datenschutzfrankfurt.de with the keyword „data breach“ in the subject line and your phone number, or use our contact form. We will get back to you as quickly as possible. We handle ongoing engagements with raised priority. The 72-hour deadline under Art. 33 GDPR runs regardless of weekday or time from the moment you become aware, which is why every hour you document earlier counts.
Do you also handle the forensic follow-up of the incident?
We advise on the technical and forensic follow-up and coordinate specialised IT forensics providers where needed, while taking the lead on legal assessment, notification and documentation.
What fines and penalties are possible?
Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.