A Data Breach at Your Company. What to Do in the First Hours to Avoid Making Things Worse

Monday morning. Your employee has sent a spreadsheet containing the data of 2000 customers to the wrong email address. IT says “it’s not our problem”, marketing wants to keep it quiet, and you have 72 hours to make a decision that could cost the company hundreds of thousands of zlotys. What do you do first?

A personal data breach can happen to any company – from a SaaS startup to a large e-commerce organization. According to data from the President of the UODO, 14,842 breach notifications were submitted in 2024, followed by 22,435 in 2025. The numbers are rising year on year. The greatest threat is not the incident itself. It is the lack of a response process – chaos, conflicting decisions, a missed notification deadline, and inconsistent documentation.

In this article, you will find a specific action plan for the first few hours after a data leak or another personal data breach. You will learn how to classify an event, when to notify the UODO, who is responsible for what, and which mistakes to avoid so that you do not make the situation worse.

Terms you need to know before an incident

Before we move on to the individual steps, let’s clarify the terminology. In the chaos following an incident, there is no time to look up definitions.

The three dimensions of a data security breach are confidentiality, integrity, and availability. A breach is not just a “leak” – it also includes unauthorized alteration of data (integrity) or loss of access to it (availability). If an external provider’s system stops working and blocks access to customer data for several hours, this may constitute an availability breach under the GDPR.

How to distinguish a security incident from a personal data breach

Not every irregularity involving data is a breach that must be notified to the UODO. But every such event requires assessment and documentation. This distinction has a direct impact on your obligations.

A personal data breach within the meaning of Article 4(12) GDPR is substantive in nature – it requires an actual security breach leading to one of five consequences: the destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data. An incorrect privacy notice on a website constitutes a violation of the GDPR, but it is not a personal data breach in this sense.

The obligation to notify the UODO arises when the breach may result in a risk to the rights or freedoms of natural persons – and that risk is more than “low”. The UODO and EDPB interpret this requirement strictly: the absence of any realistic possibility of harm must be demonstrated, not merely assumed. If in doubt, it is safer to notify.

The first 72 hours after a data breach – step by step

The 72-hour deadline for notifying a breach to the President of the UODO (Article 33(1) GDPR) begins when the controller becomes aware of the breach – not when it technically occurred. According to EDPB Guidelines 9/2022, a controller “becomes aware of a breach” when it has a “reasonable degree of certainty” (reasonable degree of certainty) that a security incident leading to a personal data breach has occurred.

This does not mean you can wait. The first indication of an incident requires you to initiate an investigation. You cannot make “awareness” conditional on the completion of a full security audit. The 72-hour period runs continuously – including weekends and public holidays.

Hours 0-6: containment and initial assessment

1. Preserve the evidence. Before fixing anything, document the facts – logs, screenshots, communications. A lack of documentation may be treated as a separate violation of the accountability principle (Article 5(2) GDPR).
2. Set up a response team. Appoint one coordinator (Incident Response Lead) to bring IT, compliance, communications, and management together in a single decision-making process. Following an incident, IT investigates the technical cause, the business wants to limit reputational damage, and compliance expects a formal analysis – without a coordinator, these activities will conflict.
3. Gather the facts. Determine: which data was affected, how many individuals were affected, the nature of the breach (confidentiality, integrity, availability), and who had or may have had access to the data.
4. Limit the impact. Block accounts, change passwords, revoke access – but do not erase traces of the incident.

Hours 6-24: classification and decision

1. Conduct a risk assessment for the individuals. Take into account: the type of data (special categories of data under Article 9 GDPR almost always create a high risk), the number of individuals, how easily they can be identified, the security measures in place (e.g. encryption), and the possibility of further dissemination.
2. Decide whether to notify. If the risk is more than “low” – notify. If in doubt – notify. The GDPR allows initial notifications (Article 33(4)) – you do not need to wait for the incident to be fully investigated.
3. Assess whether the individuals need to be notified. The threshold is higher than for notifying the UODO – notification is required where there is a high risk to the rights or freedoms of natural persons (Article 34(1) GDPR).
4. Document the decision and the reasons behind it. Even if you decide that notification is not required – document why. Article 33(5) GDPR requires the documentation of all breaches, regardless of whether they are notified.

Hours 24-72: notification and communication

1. Prepare the notification to the UODO. It must contain: a description of the nature of the breach, including the categories and approximate number of individuals, the contact details of the DPO or another contact point, a description of the likely consequences, and a description of the measures taken or proposed.
2. Submit the notification electronically. If you do not have all the information – select the “Initial notification” box and supplement it in stages.
3. Prepare a communication for the individuals affected by the breach (if required). Use clear, plain language. Do not cause panic, but do not downplay the situation. Include recommendations such as changing passwords, reporting identity documents as compromised, and monitoring bank accounts.
4. Inform the management board about the actions taken, the status of the notification, and the next steps.

Contact us if you need support with classifying an event or preparing a notification to the UODO.

Who is responsible for what – controller, processor, management board

In the chaos following an incident, one question often arises: “is this our problem or our provider’s?”. The answer is clear: the controller is responsible for notifying the UODO – even when the breach occurred on the processor’s side.

When the breach occurs on the processor’s side

The processor (e.g. a cloud, CRM, or marketing automation provider) must inform the controller of the breach without undue delay. The controller’s 72-hour deadline begins when the controller itself obtains sufficient information – not when the processor detects the problem.

Review your data processing agreements:

1. Does the agreement specify the deadline by which the processor must inform you of a breach?
2. What information must the processor provide to you?
3. Who is responsible for notifying the UODO – and is this clearly stated?

If the agreement is silent on these issues – update it before an incident occurs.

Personal liability of management board members

In Polish practice, there have been no rulings imposing administrative fines directly on management board members for mistakes in handling breaches. UODO fines are imposed on entities (controllers). Nevertheless, Article 107 of the Polish Personal Data Protection Act provides for the criminal liability of natural persons for obstructing or hindering an inspection. Article 82 GDPR also opens the door to claims for compensation by data subjects.

UODO decision DKN.5131.7.2025 concerned a situation in which the president of the management board simultaneously served as the DPO – the authority found this to constitute a conflict of interest and imposed a fine of PLN 11,365 on the company. Although the fine was imposed on the entity, it was the management board’s decisions regarding the organization of data protection that led to the violation.

Three exceptions that remove the obligation to notify individuals

Even if a breach poses a high risk, the GDPR provides for three situations in which you do not have to notify the individuals (Article 34(3)):

Note: each of these exceptions requires objective evidence, not mere assumptions. The President of the UODO may require individuals to be notified if the authority finds that the exemption conditions have not been met (Article 34(4) GDPR).

How much an inadequate response to a data leak can cost

UODO fines for failing to notify a breach or inform individuals are not abstract. Below are specific decisions from Polish practice:

The maximum fine under Article 83(4) GDPR is EUR 10 million or 2% of annual turnover – whichever is higher. For public finance sector entities, Article 102 of the Polish Personal Data Protection Act limits the fine to PLN 100,000.

Factors that increase the fine: repeated violations, failure to cooperate with the authority, and intentional conduct. Mitigating factors: voluntarily notifying the breach, promptly taking action to minimize harm, and cooperating with the UODO. Proactive notification and transparent action are not only obligations – they are also a way to limit financial risk.

Global IBM data indicates that the average cost of a data breach incident is approximately USD 4.88 million (2024 data), while the average time required to identify and contain a breach is approximately 258 days. Comparable figures for Poland are not publicly available, but the scale of the problem is growing – CERT Polska recorded 600,990 reports in 2024.

What not to do in the first few hours after a data leak

The greatest risk following an incident comes from delay, chaos, and inconsistent action – not the incident itself. Here are the most common mistakes:

1. Do not wait for a full investigation before notifying. The GDPR allows initial notifications. Waiting for an IT report may result in missing the 72-hour deadline.
2. Do not erase traces of the incident. Fixing the system without preserving evidence will make it more difficult to defend yourself before the UODO and prevent a proper root cause analysis.
3. Do not keep the matter quiet internally. A lack of communication with the management board, HR, or the legal department leads to conflicting decisions. Appoint a single coordinator.
4. Do not notify the affected individuals without preparation. Chaotic communication may cause panic and media escalation. Prepare the notification, including recommendations for the individuals concerned (changing passwords, reporting identity documents as compromised).
5. Do not assume that “it’s not our problem because the breach occurred at the provider”. The controller is responsible for notifying the UODO – regardless of whose side the incident occurred on.
6. Do not neglect documentation. Article 33(5) GDPR requires all breaches to be documented. A lack of documentation is a separate violation of the accountability principle.

How to prepare your company before an incident occurs

Responding to a personal data breach is a process that should be designed before an incident. Companies with established procedures respond faster, make fewer mistakes, and incur lower costs.

1. Develop an internal incident response procedure. Specify: who classifies the event, who coordinates the response, what the escalation channels to the management board are, and what template should be used for the initial assessment.
2. Prepare document templates. A UODO breach notification form, an individual notification template, and an internal incident documentation form (breach register).
3. Appoint an Incident Response Lead. One person who brings IT, compliance, communications, and the management board together. Without this person, each department acts independently – and makes conflicting decisions.
4. Review your data processing agreements. Check the deadline by which the processor must inform you of a breach, what information it must provide, and who is responsible for notifying the UODO.
5. Train the management board and managers. How to recognize a breach, which decisions they must make and when, and what NOT to do in the first few hours.
6. Review previous incidents and near misses. Check whether they were properly documented and whether lessons were learned.
7. Establish an “on-call” relationship with a law firm. Agree on a rapid contact procedure in the event of an incident – before one occurs.

How we can help your company with a data breach

Handling a personal data breach requires simultaneous work on several levels: legal, technical, communications, and organizational. In the first few hours after an incident, time, coordination, and accurate classification of the event are critical.

We support technology companies, SaaS businesses, e-commerce companies, and startups under two models:

Incident response:

1. Event classification – assessing whether it constitutes a breach under the GDPR and whether it must be notified
2. Preparing a notification to the President of the UODO (including initial notifications)
3. Assessing whether individuals must be notified – and preparing the notification
4. Coordinating internal and external communications
5. Documenting the course of the incident and the decisions made
6. Assistance in dealings with the UODO after the notification has been submitted

Incident readiness:

1. Developing a personal data breach response procedure
2. Preparing document templates (notification to the authority, notification to individuals, breach register)
3. Auditing data processing agreements with regard to notification obligations
4. Training the management board and managers to recognize breaches and make decisions
5. Reviewing previous incidents and near misses

Contact us to arrange a conversation about your company’s data incident readiness – before an incident occurs.

Data leak at your company – start with a process, not panic

A personal data breach can happen to any company. The difference between a company that emerges from an incident with limited losses and one that makes its situation worse lies in preparation.

Three things to remember:

1. 72 hours is the deadline for notifying the UODO – but the obligation to act “without undue delay” means that every hour counts.
2. An initial notification allows you to meet the deadline even when information is incomplete – do not wait for the analysis to be completed.
3. Documentation is mandatory regardless of the decision on notification – and serves as your line of defense before the supervisory authority.

If you want to organize your company’s breach response procedures or need support with an ongoing incident – contact us.

Frequently asked questions

How do I know whether what happened is a breach that must be notified or merely a security incident?

A personal data breach within the meaning of Article 4(12) GDPR is an event leading to the destruction, loss, alteration, unauthorized disclosure of, or access to personal data. The obligation to notify the UODO arises when such a breach may result in a risk to the rights or freedoms of natural persons – and that risk is more than “low”. The UODO interprets this requirement strictly: if you cannot demonstrate that the risk is negligible – notify. Every breach, regardless of whether it is notified, must be documented (Article 33(5) GDPR).

When does the 72-hour deadline for notifying the UODO begin?

The deadline begins when the controller becomes aware of the breach – not when it technically occurred. According to EDPB Guidelines 9/2022, this means the moment when the controller has a “reasonable degree of certainty” that an incident leading to a data breach has occurred. You do not have to wait for the full analysis to be completed – but you cannot deliberately delay becoming aware of the breach either. The deadline runs continuously (weekends and public holidays count). A notification submitted after 72 hours must include an explanation of the reasons for the delay.

If our IT provider (processor) suffered a breach, do we have to notify the UODO?

Yes. Article 33(2) GDPR requires the processor to inform the controller of the breach without undue delay. But it is the controller – not the processor – that is responsible for notifying the supervisory authority and classifying the event. The controller’s 72-hour deadline begins when the controller itself receives sufficient information from the processor. Check whether your data processing agreement specifies the deadline and scope of the provider’s breach reporting obligations.

Do I have to inform customers of a breach if the data was not particularly sensitive?

The obligation to notify individuals (Article 34(1) GDPR) arises when the breach may result in a high risk to their rights or freedoms – a higher threshold than for notifying the UODO. You assess: the type of data, the number of individuals, how easily they can be identified, the possibility of further dissemination, and the potential harm. Even “ordinary” data (name, email address, postal address) may create a high risk if, for example, it facilitates identity theft. There are three exemptions: effective encryption, elimination of the risk after the incident, and disproportionate effort (in which case a public announcement must be issued).

What penalties can a company face for failing to notify a breach?

An administrative fine of up to EUR 10 million or 2% of annual turnover (Article 83(4) GDPR). In Polish practice, the UODO has imposed fines ranging from several thousand to several hundred thousand zlotys – for example, PLN 282,960 for a repeated violation (DKN.5131.6.2023), PLN 250,000 for missing the sector-specific 24-hour deadline (P4 sp. z o.o.), and PLN 85,000 on the National Prosecutor’s Office. Fines for violations of Article 33 and Article 34 may be imposed separately and accumulated. Mitigating factors include voluntary notification, prompt remedial action, and cooperation with the authority.

How should I describe the event in a notification to the UODO without harming my position?

The notification must contain an accurate description: the nature of the breach, the categories and approximate number of individuals, the DPO’s contact details, a description of the likely consequences, and the measures taken. Do not conceal facts – but describe the event precisely and without speculation. Use the initial notification option (Article 33(4) GDPR): provide what you know and supplement the information in stages. Proactive cooperation with the authority is a mitigating factor when determining the fine (Article 83(2) GDPR). If you have no experience drafting notifications – consult a lawyer before submitting one.