regulation
GDPR
It almost certainly applies to you already. This page covers the security side: appropriate measures, processors, the 72-hour clock and being able to show your work.
- what it is
- A regulation, applying since 25 May 2018.
- who it covers
- Anyone processing personal data. That includes your staff records.
- the size line
- None for security. Under 250 staff you may skip records of processing only if processing is occasional, low-risk and has no special categories.
- fine ceilings
- €10 million or 2% for security and breach duties. €20 million or 4% for basic principles.
- who answers
- The controller, and processors in their own right.
- status
- Applying. A proposal would lengthen the breach clock, and it is not law.
basis GDPR Art. 2(1), 30(5), 32(1), 83(4), 83(5), 99(2)
what the security side comes down to
GDPR is long, and only part of it overlaps with the other rules. That part comes down to four things.
- Security sized to the risk to people. Encryption where it fits, confidentiality and availability of systems, the ability to restore, and regular testing that it all works.
- Proof. You are responsible for compliance and must be able to demonstrate it.
- Processors you checked. Only those offering sufficient guarantees, under a contract with listed terms.
- A breach routine. Tell the authority, sometimes tell the people, and always keep a log.
basis GDPR Art. 5(2), 24(1), 28(1), 28(3), 32(1), 33(5)
a breach, step by step
a personal data breach, step by step
- Did personal data get lost, disclosed, changed or accessed without authority?yesnoIt may still be a security incident. Check the other clocks.
- Is a risk to people unlikely?noyesNo notification needed. Record the breach and your reasoning.
- Is the risk to people high?either wayyesAlso tell those people, without undue delay.
- Tell the authority within 72 hours where feasible. Phases are allowed. Log it.
basis GDPR Art. 33(1), 33(4), 33(5), 34(1)
The clock starts when you become aware. The European Data Protection Board treats that as a reasonable degree of certainty that a breach happened, after a short investigation that starts promptly. Waiting for the full picture is how Booking.com earned its fine.
basis GDPR Art. 33(1); EDPB Guidelines 9/2022
why paperwork decides these cases
A breach does not prove your security was inadequate. You still have to prove it was adequate.
The Court of Justice said both halves in December 2023. Unauthorised access alone does not show that your measures were inappropriate, and in a damages claim you carry the burden of proving they were appropriate. The case page has more. In practice, that makes the evidence below the part that protects you.
from a control to an answer
- 1the control runsan access review, a restore test, a board decision
- 2it leaves a recorda dated export, a signed sheet, a minute
- 3an owner checks ita named person, on a set rhythm
- 4it gets filedone place, named by date and control
the same file answers
- your boardwhat did we decide, and is it running?
- an auditorshow me the last one
- a regulatorwere your measures appropriate?
- a customerthe security questionnaire
basis GDPR Art. 5(2), 24(1); NIS2 Art. 21(2)(f)
basis Court of Justice, C-340/21; GDPR Art. 5(2), 24(1), 32(1), 82(3)
what may change
The Digital Omnibus, proposed in November 2025, would amend GDPR. Coverage reports a 96-hour clock, notification only for high-risk breaches, and a Council preference for national entry points. That was not checked against a final Council mandate, and Parliament’s page shows it awaiting a committee decision. Today the rule is 72 hours.
basis procedure 2025/0360(COD); GDPR Art. 33(1)
the work under GDPR
- incident reportingOne event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
- supplier riskYour suppliers' failures count as yours. Three rules ask for the same thing: know who they are, look at them in proportion, and put security in the contract.
- the board's partSecurity decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
- access controlWho can get in, who said so, and when someone last checked. Every rule asks the same thing in slightly different words, which makes this the most reusable work on the site.
- risk assessmentEvery rule says appropriate to the risk. Without a written assessment you cannot show that anything you did was appropriate, and you have no honest way to do less.
- backups and recoveryA backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that shows the control runs.
- trainingThree rules ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
- patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.
check it yourself
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- European Parliament, Legislative Observatory: procedure 2025/0360(COD), Digital Omnibus
- EDPB Guidelines 9/2022 on personal data breach notification, version 2.0
- Court of Justice of the EU, C-340/21, judgment of 14 December 2023
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Pick one recent security event and write down, in one paragraph, whether it was a personal data breach and why.