When to notify individuals of a data breach (Article 34)

Tell the people affected without undue delay when a breach is likely to result in a high risk to them, unless one of three exceptions applies. Below: how to judge high risk, the exceptions, and a message you can adapt.

The rule in Article 34

When a personal data breach is likely to result in a high risk to the rights and freedoms of people, the controller must communicate the breach to those people without undue delay [1][2]. Two thresholds sit side by side in the GDPR:

Risk: notify the supervisory authority (Article 33). See the 72-hour guide.
High risk: also tell the people affected (Article 34).
Unlikely to result in a risk: no notification, but you still document it (Article 33(5)). See the breach register template.

There is no fixed hour count for telling people. The words are "without undue delay" [1]. The point is to let people protect themselves, for example by changing a password or watching their bank account, so speed matters.

How to judge "high risk"

The GDPR does not give a formula. The EDPB guidelines point to these inputs when assessing the risk [3]:

the type of breach (confidentiality, integrity or availability);
the nature, sensitivity and volume of the personal data affected;
how severe the possible impact on people is, and how likely it is to happen;
whether the people affected are vulnerable, which can expose them to greater risk.

Look at both how likely harm is and how bad it would be. Health data, financial details, identity documents and passwords tend to push a case toward high risk. A single misdirected email to a trusted recipient who confirms deletion tends to push it the other way. The EDPB's book of examples shows the same kind of incident landing on different sides of the line depending on these factors [4].

Three examples from the EDPB

The EDPB Guidelines 01/2021 work through cases and say for each one whether people should be told [4]. Three ransomware cases show the range:

Small company, good backup, no data taken out: data restored within hours from backup and logs showed no data leaving the network. Not treated as high risk, so no communication to people.
Hospital, backup, no data taken out: treated as high risk because patient care was disrupted. Documented, notified to the authority and communicated to the patients.
Public transport operator, no usable backup, data taken out: identity and payment data were exposed. Treated as high risk because the data can be used for fraud.

The three exceptions

Article 34(3) says you do not have to tell people if any of these applies [1]:

The data was unintelligible to others. You had appropriate protection in place, such as encryption, that makes the data unintelligible to anyone not authorised to access it. The EDPB gives state-of-the-art encryption as an example and notes that a lack of backup can still make a breach of encrypted data reportable [3].
The high risk is no longer likely. You took steps afterwards that mean the high risk is no longer likely to materialise.
It would take disproportionate effort. Then you must instead use a public communication or a similar measure that informs people in an equally effective way.

The supervisory authority can also order you to tell people, or decide that one of the exceptions applies [1]. Document which exception you relied on and why.

What the message must say

Article 34(2) requires the message to describe the nature of the breach in clear and plain language and to contain at least [1][5]:

the name and contact details of the data protection officer or another contact point;
the likely consequences of the breach;
the measures taken or proposed to address the breach, including measures to reduce its possible adverse effects.

A practical tip: send it as its own message through a channel that reaches people directly, such as email or a letter, so it is not missed among routine updates. The EDPB stresses giving people information on the steps they can take to protect themselves [3], so add concrete advice.

Template: message to the people affected

Subject: Important: a security incident involving your personal data

Dear [name],

On [date] we found that [plain description of what happened, for
example: an unauthorised person accessed our customer database].

What data is involved: [for example: your name, address and the
last four digits of your card number].

What this could mean for you: [likely consequences, for example:
you may receive phishing emails that look like they come from us].

What we have done: [for example: we closed the access, reset all
passwords and reported the incident to the data protection authority].

What you can do: [concrete steps, for example: change your password,
be careful with emails asking for payment details, check your bank
statements].

Questions: contact [name of DPO or contact point] at [email / phone].

We are sorry this happened.
[Organisation name]

Worked example

An invented example. A sports club's membership system is accessed by an attacker. The data: names, birth dates, home addresses and medical notes for 300 members, about a third of them children. The data was not encrypted.

Risk factors: health data, children, unencrypted, deliberate attack.
Conclusion: high risk. Notify the authority within 72 hours and tell the members, or the parents of the children, without undue delay.
Exceptions: none apply. The data was readable and the attacker cannot be traced.
Channel: direct email to each member or parent, a letter where no email address is on file.
Record: the risk reasoning, the date and channel of the message, and a copy of the text in the breach register.

Deciding how to run this in your organisation? Read spreadsheet vs tool vs consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.