Data breach: how to report within 72 hours without panicking
Under the GDPR, a personal data breach notification must reach the supervisory authority within 72 hours if the breach may put people at risk. In Spain, that authority is usually the AEPD, the Spanish data protection agency. The clock starts when you become aware of the incident, not when it happened. So what makes the difference is having the procedure ready beforehand.
In 30 seconds: file a data breach notification with the AEPD through its e-office within 72 hours. The only exception is a breach that is unlikely to create any risk. If the risk is high, also tell the people affected without undue delay. In addition, record every breach, including those you do not notify. And if NIS2 or DORA applies to you, other clocks run in parallel.
What counts as a personal data breach and when notification is due
The General Data Protection Regulation defines it as a security breach that destroys, loses or alters personal data. It also covers disclosure of, or access to, that data without authorisation. A breach can affect three dimensions:
- Confidentiality: an email with customer data sent to the wrong recipient, or unauthorised access.
- Integrity: data altered without authorisation, by mistake or in bad faith.
- Availability: ransomware that encrypts the database, or a deletion with no backup.
Not every security incident is a personal data breach, and not every breach is a cyberattack. A lost laptop counts too. What decides whether you must notify is the risk to people, not to your company. So a data breach notification is due unless a risk is unlikely, and you tell the people affected when the risk is high.
The 72-hour deadline in Article 33
When the clock starts
You must send the data breach notification without undue delay and, where feasible, within 72 hours of becoming aware. The European Data Protection Board’s Guidelines 9/2022 explain this, and version 2.0 from 2023 remains current. According to the EDPB, you are aware once you are reasonably certain that a security incident has compromised personal data. You may investigate briefly, but you cannot delay the decision. If you are late, the notification must give the reasons for the delay.
If a processor suffers the data breach, it must inform you without undue delay. In that case, your data breach notification clock starts when the processor tells you. Therefore, set out that duty in the contract and, where DORA applies, in your register of ICT third-party providers.
What a data breach notification must include
- The nature of the breach, with the categories and approximate number of people and records affected.
- Contact details for the data protection officer or another contact point.
- The likely consequences for the people affected.
- Measures taken or proposed, including those that mitigate its effects.
If you lack some details at 72 hours, you can complete the data breach notification in phases. However, the first notice must arrive on time.
How to file a data breach notification with the AEPD
The AEPD only accepts a data breach notification through the form on its e-office. To use it, you need to identify yourself with an electronic certificate or Cl@ve, Spain’s digital ID system. The form guides you through specific questions and lets you file a new notification or modify an earlier one. You will use that second option to complete the information in phases.
The controller notifies, although it can authorise a representative. If your main establishment in the EU is in another country, you notify that country’s authority instead. For public bodies in Catalonia, the Basque Country and Andalusia, notification goes to the regional authority. Before you file, the AEPD’s Asesora Brecha tool helps you decide whether you must notify. You will find every resource on the AEPD’s data breach page.
Data breach notification to the people affected
Article 34 requires you to tell people without undue delay when the data breach poses a high risk to them. The message must use clear and plain language. It must also explain what happened, the likely consequences, the measures you took and a contact point.
You do not have to tell them in three cases. First, if you had encrypted the data and it remains unintelligible. Second, if you have taken measures that remove the high risk. Third, if contacting each person would take disproportionate effort; a public communication then suffices. To assess the risk, the AEPD offers a free tool, Comunica-Brecha RGPD. Even so, the final decision is yours, and the AEPD can order you to communicate.
The internal breach register
Article 33(5) requires you to document every personal data breach, including those you decide not to notify. Record the facts, their effects, the remedial action and the reasoning behind your decision. Moreover, it is one of the first things the AEPD may ask for in an investigation. It also feeds your risk analysis and your GDPR compliance checklist.
GDPR, NIS2 and DORA: three different clocks
A single cyberattack can trigger several notifications at once, each with its own recipient and deadlines:
| Law | What you report and to whom | Deadlines |
|---|---|---|
| GDPR | Personal data breach, to the AEPD. | 72 hours; to the people affected, without undue delay if the risk is high. |
| NIS2 | Significant incident, to the CSIRT or competent authority. | Early warning within 24 hours, notification within 72 hours and a final report within one month. |
| DORA | Major ICT-related incident, to the financial supervisor. | Initial notice within 4 hours of classifying it as major (24 hours at most from awareness), intermediate within 72 hours, final within one month. |
Spain has still not transposed NIS2, so Royal Decree-law 12/2018 applies to essential operators and digital service providers. We cover this in NIS2 transposition still pending in Spain. In any case, the data breach notification to the AEPD is separate: reporting to the CSIRT or your financial supervisor does not replace it.
Frequently asked questions about data breach notification
How long do you have for a data breach notification?
A maximum of 72 hours from becoming aware, without undue delay. If a processor suffers the breach, the period runs from when it informs you. And if you are late, you must justify the delay in the notification itself.
Do you have to report every breach?
No. You only file a data breach notification if the breach is likely to pose a risk to people’s rights and freedoms. However, you must record all breaches and document why you decided not to notify.
What happens if you notify late or not at all?
Breaching Article 33 or 34 can lead to fines of up to €10 million or 2% of worldwide annual turnover. In addition, the AEPD can penalise a lack of appropriate security measures under Article 32 separately.
Can you notify without all the information?
Yes. Send what you know on time, then complete it later with the option to modify the notification on the e-office.
Will the Digital Omnibus change the 72-hour deadline?
Not for now. In November 2025 the Commission proposed notifying only high-risk breaches, within 96 hours and through a single EU entry point. But as at 14 October 2026, the proposal still awaits a committee vote in the European Parliament. Meanwhile, the EDPB adopted a common notification template in June, with its roll-out still to come.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with data breach notification
Atalaya GRC logs each incident or personal data breach and guides you through the risk assessment. It then starts the GDPR, NIS2 and DORA clocks that apply to you, service by service. The regulatory clock alerts the owners before each deadline. In addition, it keeps the breach register, every data breach notification and its evidence in one place, alongside the third-party register to locate the processor involved. See the GDPR guide or request a demo.
