Personal data breach: what do you do in the first 72 hours?

Published 28 October 2026

Summary: Once you have become aware of a personal data breach, you must notify IMY (the Swedish Authority for Privacy Protection) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the data subjects. The clock starts when you are reasonably certain that personal data have been compromised, not when the investigation is finished, and what is not yet known may be provided in phases. If the breach is likely to result in a high risk, the data subjects must also be informed without undue delay. Every breach is documented, including those that are not notified.

What counts as a personal data breach?

Under Article 4(12), a personal data breach is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to” personal data. Mistake or intent makes no difference. The European Data Protection Board (EDPB) distinguishes three types, which can occur together:

• Confidentiality: unauthorised people gain access to the data, for example through an email to the wrong recipient.
• Integrity: data are altered without authorisation.
• Availability: data are destroyed or cannot be reached, for example after a ransomware attack.

Not every security incident is a personal data breach, so first ask whether personal data have actually been affected.

When does the clock start?

Notification must be made “without undue delay and, where feasible, not later than 72 hours after having become aware of it” (Article 33(1)). According to the EDPB, you are aware when you have a reasonable degree of certainty that a security incident has compromised personal data. A short initial investigation is allowed, but it must start straight away. Two examples from the EDPB guidelines:

• A USB stick holding unencrypted personal data is lost. The clock starts when you realise it is gone, even if you do not know whether anyone has read the data.
• An attacker demands a ransom. The clock starts once you have checked that the system has in fact been attacked.

A processor, for example a cloud service, must notify you without undue delay (Article 33(2)), and according to the EDPB you are in principle aware once the processor has informed you. The 72 hours are counted in hours, with Saturdays, Sundays and public holidays included. Write down the time straight away.

Do IMY and the data subjects need to know?

The GDPR has two thresholds. A breach must be notified to IMY unless it is unlikely to result in a risk to the rights and freedoms of natural persons. The data subjects must be informed when it is likely to result in a high risk (Article 34(1)).

Your assessment of the risk	Notification to IMY	Communication to data subjects
Unlikely to result in a risk	No, but document the assessment	No
Risk	Yes, where feasible within 72 hours	Not required
Likely high risk	Yes, where feasible within 72 hours	Yes, without undue delay

IMY and the EDPB name the same risk factors: the type of breach, which data are affected and how sensitive and extensive they are, how easily the people can be identified, how severe the consequences could be, whether the people are particularly vulnerable, for example children, and how many are affected. If in doubt, the EDPB recommends that you notify.

Encryption can change the assessment. According to the EDPB, a lost mobile device encrypted with a strong method, where the key has not been compromised, does not always need to be notified, provided a copy of the data exists.

What the notification to IMY must contain

Under Article 33(3), the notification must at least contain:

• the nature of the breach and, where possible, the approximate number of data subjects and personal data records concerned,
• contact details for the data protection officer or another contact point,
• the likely consequences,
• the measures taken or proposed, including those to mitigate the damage.

The notification is made through IMY’s e-service and becomes an official document (allmän handling). If someone requests it, IMY assesses whether the information is confidential under the Public Access to Information and Secrecy Act, and in the form you can describe which information you consider should be kept confidential. Even so, do not include more information than necessary. Approximate figures are enough; the EDPB says precision should not delay notification.

Notifying in phases

What is not yet known may be provided “in phases without undue further delay” (Article 33(4)). State in the first notification that more information will follow. According to IMY, it may decide on the information it has if no supplement has arrived after 4 weeks. A notification made later than 72 hours must give reasons for the delay. If there turns out to be no breach, update the notification; the EDPB says there is no penalty for having notified.

How to inform the data subjects

The communication must describe in clear and plain language the nature of the breach, the contact point, the likely consequences and the measures (Article 34(2)). The EDPB advises a dedicated message rather than a line in a newsletter, direct channels such as email, text message or letter but not one the attacker can reach, and concrete advice, for example to change passwords.

Communication is not required if the data were unintelligible to unauthorised persons, for example through encryption, if later measures mean the high risk is no longer likely to materialise, or if it would involve disproportionate effort. In the last case, a public communication or a similar measure is used instead (Article 34(3)).

Document every breach

Article 33(5) requires you to document any personal data breaches, “comprising the facts relating to the personal data breach, its effects and the remedial action taken”. This includes breaches that are not notified. IMY and the EDPB recommend that you also record the reasons for your decisions, in particular why a breach was not notified. In our division of the GDPR into 15 parts, this is part 15, personal data breaches.

When the Cybersecurity Act also applies

If you are covered by the Swedish Cybersecurity Act (cybersäkerhetslag 2025:1506), in force since 15 January 2026, the same event may be a significant incident. It is reported to the National Cyber Security Centre (NCSC) through its portal Cyberportalen, in three steps:

• An initial notice (upplysning) as soon as possible and no later than 24 hours after becoming aware of the incident (Chapter 2, Section 5 (2 kap. 5 §)).
• An incident notification (incidentanmälan) no later than 72 hours after becoming aware, or 24 hours for providers of trust services (Chapter 2, Section 6 (2 kap. 6 §)).
• A final report no later than one month after the incident notification, or a progress report if the incident is still ongoing (Chapter 2, Section 8 (2 kap. 8 §)).

This does not replace notification under the GDPR. The NCSC states that an incident that is also a personal data breach must be reported to both the NCSC and IMY. The deadlines run separately, so let your incident process decide on both at the same decision point. Read more in our insight on the GDPR and the Cybersecurity Act together.

A checklist for the first 72 hours

1. Write down when and how you became aware of the breach.
2. Contain the damage: shut off access, change passwords and ask a wrong recipient to delete the data.
3. Bring in whoever leads the response, IT and the data protection officer if you have one.
4. Establish which data and approximately how many people are affected.
5. Carry out the risk assessment and document it, even if no notification is needed.
6. Ask any processors involved for their report.
7. If the Cybersecurity Act applies, give the initial notice to the NCSC within 24 hours.
8. Notify IMY within 72 hours if required, even if not everything is known.
9. Inform the data subjects in a dedicated message if the risk is likely to be high.
10. Record the facts, effects, measures and decisions in the breach log.

When the procedure is in place, you have a named owner, a known internal reporting route, a risk assessment template, processor agreements with prompt reporting and a log of every breach.

Would you like a breach procedure that works when it actually happens? Kristensson i Skåne AB helps organisations with data protection and privacy. Our ongoing GDPR support includes support in personal data breaches, from deciding whether a breach must be notified to the documentation afterwards.

Sources: GDPR, Regulation (EU) 2016/679, Articles 4(12), 33 and 34 (EUR-Lex); EDPB Guidelines 9/2022 on personal data breach notification; IMY guidance on personal data breaches; the Swedish Cybersecurity Act (2025:1506), Chapter 2, Sections 5–8 (2 kap. 5–8 §§) (riksdagen.se); NCSC on incident reporting under the Cybersecurity Act; Regulation (EEC, Euratom) No 1182/71 on time limits. Verified 2026-10-03.

This text is general information and not legal advice. Every breach must be assessed on its own facts.