Friday, 5:43 p.m. Your developer posts on Slack: “Hey, I think we have a user database leak.” From that moment, the clock is running. You have 72 hours to report the personal data breach to the President of the Polish Personal Data Protection Office (PUODO). If you do not know who handles incidents in your company, how to assess risk or what to include in the report, those 72 hours can pass faster than you expect.
In 2024, PUODO received 14,842 personal data breach notifications, more than 5% above the previous year. Total fines imposed by the authority rose from about PLN 1.23 million in 2023 to about PLN 13.9 million in 2024. In 2025, they exceeded PLN 64 million. The authority fines selectively but strictly, especially for failing to report, lacking procedures or failing to conduct a sound risk assessment.
This guide covers what to do during the first 72 hours after discovering a data breach, step by step. It explains how to assess risk, what a notification must contain, when to inform affected individuals and how to prepare before an incident occurs.
Key terms you need to know
Before following the procedure, clarify these terms used throughout the article.
| Term | Meaning |
|---|---|
| Personal data breach | An event leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. It may affect confidentiality (unauthorized access), integrity (data changed) or availability (data unavailable, for example after ransomware). |
| Data controller | The entity deciding why and how personal data is processed. If your SaaS business collects user data, you are the controller. |
| Data processor | A company processing data on your behalf, such as a hosting provider, email-marketing tool or external software house. Under Article 33(2) GDPR, a processor must notify you of a breach without undue delay. |
| DPO | Data Protection Officer, appointed to monitor GDPR compliance. Not every company is required to appoint one; the article explains when this is required. |
| PUODO | The President of the Polish Personal Data Protection Office, the supervisory authority in Poland to which breaches are reported. |
| Breach register | An internal record of every breach, including those not reported to PUODO. The duty arises under Article 33(5) GDPR. |
How to calculate 72 hours: when the clock starts
The 72-hour period does not start when the breach actually occurred. It starts when the controller has sufficient certainty that an incident has happened.
Examples:
| Scenario | When the 72 hours start |
|---|---|
| An employee notices suspicious database access and reports it to the DPO | When the DPO confirms that a breach occurred |
| A customer tells you that they found their data online | When you internally confirm that the data was in fact exposed |
| A processor, such as a hosting provider, informs you of an attack on its servers | When you receive the information from the processor; you are considered aware from that point |
| Ransomware encrypts the database on Friday evening and nobody works until Monday | When anyone in the organization identifies the breach. This is why you need an out-of-hours response procedure. |
Important: if an employee knows about a breach, you as controller know about it too. The clock does not wait for a formal investigation. Keep the escalation path short and make sure everyone in the company knows it.
If you cannot collect all the information within 72 hours, report what you know and provide additional information in stages. Article 33(4) GDPR expressly allows phased notifications. PUODO does not penalize an incomplete initial report if you actively cooperate and provide missing information without undue delay.
What to do in the first 72 hours: step-by-step procedure
The timeline below takes you from discovering an incident to notifying PUODO. Each step has an owner and an outcome.
Step 1: internal report (0 to 2 hours after discovery)
The person who notices a suspected breach informs their manager and the DPO, or the person designated to handle incidents. The report should state:
- What happened, described in the reporter’s own words.
- When it was noticed, including date and time.
- What data may be involved.
- Who may be affected, such as customers, employees or users.
Do not wait for certainty. It is better to report a suspicion that turns out to be a false alarm than to miss a real breach.
Step 2: technical containment (0 to 4 hours)
IT secures evidence and limits the impact:
- Block unauthorized access by changing passwords and terminating sessions.
- Secure system logs and backups.
- Isolate infected systems in a malware or ransomware attack.
- Document technical actions, including what was done, when and by whom.
Separate responsibilities: IT handles the technical response; the DPO assesses legal risk. If the roles are mixed, time is lost.
Step 3: assess risk (4 to 24 hours)
Decide whether the breach must be reported to PUODO and/or affected individuals. GDPR distinguishes two risk thresholds:
| Risk level | Duty | Legal basis |
|---|---|---|
| No risk to individuals’ rights and freedoms | Document internally in the breach register. No duty to notify PUODO. | Article 33(5) GDPR |
| Risk to individuals’ rights and freedoms, any level | Notify PUODO within 72 hours | Article 33(1) GDPR |
| High risk to individuals’ rights and freedoms | Notify PUODO and inform the affected individuals | Articles 33(1) and 34(1) GDPR |
Note: PUODO interprets the exception to notification very narrowly. In a decision concerning a court bailiff, the authority found that “unlikely” risk effectively means a situation close to no risk, with no realistic prospect of adverse effects. Any discernible possibility of harm will generally rule out non-notification.
Step 4: notify PUODO (within 72 hours)
If the risk assessment shows that notification is required, submit it using the form on biznes.gov.pl. It must include at least four elements:
- Nature of the breach: data categories, approximate number of affected individuals and approximate number of data records.
- DPO contact details or another company contact point.
- Likely consequences for the affected individuals.
- Mitigation measures: actions taken or planned to address the breach and limit its effects.
The form lets you mark the notification as preliminary. Provide missing information in stages, without undue delay.
If you report after 72 hours, explain the reasons for the delay.
Step 5: inform affected individuals if the risk is high
If the breach is likely to result in high risk to people’s rights and freedoms, you must notify them without undue delay under Article 34(1) GDPR. The notice should include:
- A description of the breach in simple, clear language.
- DPO or other contact-point details.
- A description of likely consequences.
- Recommendations to reduce adverse effects, such as changing passwords or monitoring a bank account.
Prepare a notice template in advance. During a crisis, you may not have time to write one from scratch.
Step 6: record the breach
Every breach, whether or not it is reported to PUODO, must be entered in the internal breach register. The register should include:
- Date and circumstances of the breach.
- Type: confidentiality, integrity or availability.
- Categories and number of affected individuals.
- Consequences.
- Mitigation measures taken.
- The decision to notify or not notify PUODO, with reasons.
- Whether affected individuals were informed, if applicable.
No register during a PUODO inspection is evidence of systemic GDPR non-compliance. This is a separate breach of Article 33(5) GDPR.
How to assess breach risk: a simplified ENISA method
Risk assessment is where many companies get stuck. They do not know how to decide whether a breach must be reported. The European Union Agency for Cybersecurity (ENISA) has developed a method to structure the assessment.
Formula: breach severity = DPC × PI + BC
It has three components:
DPC: data-processing context, or baseline sensitivity
| Data category | Baseline value |
|---|---|
| Basic data, such as name, surname and address | 1 |
| Behavioral data, such as login history and preferences | 2 |
| Financial data, such as account numbers and transaction data | 3 |
| Special-category data, such as health or biometric data | 4 |
Adjust the baseline by plus or minus 1 for context: a wide range of data about one person increases it; data about children increases it; data previously available to the public reduces it; outdated data reduces it.
PI: probability of identification
| Probability | Multiplier |
|---|---|
| Negligible, data effectively anonymized | 0.25 |
| Limited, identification requires effort | 0.50 |
| High, data can be combined with readily available information | 0.75 |
| Maximum, direct identifiers such as PESEL or email address | 1.00 |
BC: breach circumstances, or increments
| Circumstance | Increment |
|---|---|
| Disclosure to known, limited recipients | +0.25 |
| Disclosure to unknown recipients, such as online publication | +0.50 |
| Integrity breach where repair is possible | +0.25 |
| Availability breach where data cannot be recovered | +0.50 |
| Intentional, malicious conduct, such as a hacking attack | +0.50 |
Interpreting the result:
| Score | Risk level | Action |
|---|---|---|
| Below 2 | No or minor inconvenience | Document internally; consider not reporting, while taking PUODO’s narrow interpretation into account. |
| 2 to 4 | Noticeable, reversible harm | Notify PUODO. |
| Above 4 | Significant, potentially irreversible consequences | Notify PUODO and the affected individuals. |
The ENISA method is not legally binding; it is an aid. A low score does not automatically mean you may omit notification. Its main purpose is to document the decision-making process, demonstrating accountability to PUODO.
PUODO fines in practice: what decisions show
In 2024, PUODO imposed monetary penalties in 22 cases, relatively few compared with 14,842 breach notifications. But penalties are increasing, and the pattern in the decisions is clear.
| Entity | Fine | Reason |
|---|---|---|
| Santander Bank Polska | PLN 1,440,000 | Failure to notify PUODO of a breach, following an earlier PLN 545,000 fine for failure to notify affected individuals. |
| Toyota Bank Polska | PLN 78,000 | Failure to report a breach within 72 hours. |
| District prosecutor’s office | PLN 20,000 | Failure to report and notify individuals after non-anonymized data was sent to a journalist. |
| Court bailiff | PLN 20,900 | Failure to report (PLN 7,700) and notify the individual (PLN 13,200) after a letter was sent to the wrong recipient. |
| “Maraton” association | PLN 916.71 | No risk assessment, procedures or training after a volunteer exposed data of more than 100 participants on social media. |
Common features of these decisions:
- In every case, PUODO penalized a lack of sound risk analysis or response procedures, not a minor delay.
- Sanctions concerned complete failure to report, not an incomplete or slightly late report.
- A repeated breach after an earlier penalty was an aggravating factor, as in the Santander Bank Polska case.
- Even small organizations must have procedures and train people who process data.
The lesson: PUODO does not target minor delays. It penalizes the absence of a system, including missing procedures, registers, risk assessments or responses.
Does your company need a DPO?
The duty to appoint a Data Protection Officer comes from Article 37 GDPR and depends on the nature of processing, not the number of employees. The myth about a 250-employee threshold concerns only the duty to keep a record of processing activities under Article 30(5) GDPR, and even that rule is conditional.
Three situations require a DPO:
| Ground | Who it applies to | Examples |
|---|---|---|
| Public authority or body | All public authorities, except courts acting in their judicial capacity | Government offices, public schools and public hospitals |
| Core activities involve regular and systematic large-scale monitoring of people | Businesses whose core activity requires tracking user behavior | Analytics platforms, behavioral advertising tools, scoring systems and user-profiling apps |
| Core activities involve large-scale processing of special-category data | Businesses processing health, biometric or genetic data at scale | Hospitals, diagnostic laboratories, telemedicine platforms and medtech startups |
If your company meets none of these grounds, it is not formally required to appoint a DPO. It must still designate someone to coordinate incident response and make sure everyone knows whom to contact.
The DPO may be an employee or an external service provider. A data-processing agreement is not required for the DPO role, but the DPO must be independent: they cannot receive instructions on performing their tasks or hold a decision-making position in areas involving data processing, such as head of IT or HR.
Breaches involving processors: what your agreement should cover
External IT, hosting and SaaS providers can all be sources of breaches. Article 33(2) GDPR requires a processor to notify you without undue delay after discovering a breach. The problem is that GDPR does not specify a numerical deadline.
Set out the following in your data-processing agreement:
- A specific notification deadline, for example 24 hours after discovering an event or suspected breach; contracts commonly use 24 to 48 hours.
- The information the processor must provide, sufficient for you to meet Article 33(3) GDPR.
- A duty to cooperate in establishing the circumstances and securing evidence.
- Responsibility for delay: Article 82 GDPR provides for joint and several liability of controller and processor for damage resulting from an infringement.
Remember: the processor does not notify PUODO or the affected individuals. That duty rests with you as controller. If the processor delays notifying you, you lose time from your 72-hour reporting window.
Review your IT vendor agreements. If they do not include a breach-notification clause, add one.
How to prepare your company before an incident occurs
The 72-hour procedure does not begin when data leaks. It begins with your company’s ability to detect an incident and activate a response. Without a procedure, register and trained team, 72 hours may not be enough.
Checklist: what to implement before the first breach
| Action | Priority | Owner |
|---|---|---|
| Internal breach-response procedure with a clear escalation path | Required | DPO/designated person and board |
| Appoint a breach-response coordinator, DPO or another person, with contact details known throughout the company | Required | Board |
| Personal data breach register, ready to use even if empty | Required | DPO/designated person |
| Breach assessment report template covering date, circumstances, data categories, number of people, risk assessment and mitigation | Required | DPO/legal team |
| Training for all employees and collaborators on what constitutes a breach, whom to notify and when | Required | DPO and HR |
| IT/DPO incident-response process covering evidence, access blocking and log analysis | Recommended | CTO/IT and DPO |
| Template notice to affected individuals under Article 34 GDPR | Recommended | DPO/legal team |
| Annual tabletop breach simulation measuring response time | Recommended | DPO, IT and board |
| Review processor agreements for breach-notification clauses | Recommended | Legal team |
| Cyber insurance covering incident-response costs | Optional | CFO/board |
Training does not need to last hours. Thirty minutes with a short test confirming that employees know the procedure may be enough, provided it is repeated regularly and includes new employees.
Breach procedures and company data protection: how we can help
The absence of a breach-response procedure creates not only a risk of a PUODO fine, but also chaos when the company needs calm and precision. During an inspection, PUODO asks not only whether you reported on time, but whether you have a breach register, a risk-assessment process, a trained team and documented decisions.
We help technology, SaaS and e-commerce businesses organize data protection, from process audits and breach procedures to advice during incidents.
Our support includes:
- Data-processing audit: review how your company collects, stores and shares personal data, and identify gaps.
- Breach-response procedure: create a document suited to your organization, with allocated roles, escalation steps and templates.
- Breach register and templates: prepare practical tools, including a register, breach-assessment report and notice to affected people.
- Team training: short, practical sessions for employees and managers, with acknowledgment of completion.
- Incident support: help assess risk, prepare a PUODO notification and communicate with affected people.
- External DPO services: act as your Data Protection Officer.
If your company processes data about users, customers or employees, check that your procedure is ready for a real incident. Contact us to prepare a procedure, register and templates before you need them.
Data breach at a company: summary and next steps
The 72-hour period does not wait for weekends, holidays or internal discussions. It starts when anyone in the company learns of the breach, whether that person is the DPO, a developer or an intern.
PUODO penalizes the absence of a system more than minor delays: missing procedures, registers, risk assessments or responses. Implementing a procedure costs a fraction of a potential penalty and a fraction of the cost of chaos when an unprepared organization faces an incident.
Three things to do now:
- Check that you have an internal breach procedure and a designated responsible person.
- Make sure the breach register exists and is ready to use.
- Verify that employees know whom to notify and how to report a suspected data leak.
If any element is missing, contact us. We can help prepare your company before an incident occurs.
Frequently asked questions
Does my company, with 15 people and a B2B SaaS business, really need a formal breach procedure?
Yes. Article 33(5) GDPR requires documentation of every breach, regardless of company size. Without a procedure, you may be unable to meet the 72-hour deadline or document the risk assessment. PUODO even fined a small association PLN 916.71 for lacking procedures and training. A smaller organization is not exempt.
Exactly when do the 72 hours start: when an employee notices a problem or when the DPO confirms the breach?
The period starts when the controller has sufficient certainty that a breach occurred. If an employee reports a suspicion and the DPO confirms it after review, it starts at confirmation. But if an employee already has enough information to establish a breach, for example, customer data is visibly posted online, the clock starts when the employee learns of it.
What if I am not sure whether there was a breach? Is it safer to report “just in case”?
PUODO interprets the exception to reporting narrowly: “unlikely” risk means a situation close to no risk. If in doubt, reporting is safer. PUODO does not penalize a report about a breach that turns out to be less serious than expected. It penalizes failure to report when reporting was required.
Which breaches do not need to be reported to PUODO?
Only breaches where risk to individuals’ rights and freedoms is unlikely, for example, an encrypted laptop with a current backup where the encryption key was not compromised. Even then, record the breach internally. A missing register is a separate breach of Article 33(5) GDPR.
Must my processors, such as hosting or SaaS providers, notify me of a breach, and when?
Yes. Article 33(2) GDPR requires a processor to notify the controller without undue delay. GDPR does not set a specific number of hours, so agree one in the contract, for example, 24 hours after discovering an event or suspected breach. If your data-processing agreement has no such clause, add it. A processor’s delay reduces your time to notify PUODO.
What penalties apply to a late breach notification?
PUODO may impose administrative fines of up to EUR 10 million or 2% of annual turnover for organizational-duty violations under Article 83(4) GDPR. More serious violations may result in fines of up to EUR 20 million or 4% of turnover under Article 83(5). Articles 107 and 108 of the Polish Personal Data Protection Act also provide for criminal sanctions. Existing Polish fines have ranged from under PLN 1,000 to PLN 1.44 million, while the aggregate amount of fines has increased year over year.
