콘텐츠로 건너뛰기

Personal Data Breach: What to Do Within 72 Hours

Leak, hack, wrong recipient: when to notify the CNIL within 72 hours, when to inform affected people and what to record. A step-by-step method.

Personal Data Breach: What to Do Within 72 Hours

Small business team gathered around a computer to handle a data leak incident

A personal data breach must always be documented internally. If it poses a risk to the people concerned, it must be reported to the CNIL without undue delay, and no later than 72 hours after it was discovered. If the risk is high, you must also inform the affected people directly.

Key takeaways:

  • Every personal data breach, even one with no consequences, must be recorded in an internal register.
  • Notifying the CNIL is mandatory as soon as there is a risk to people's privacy, no later than 72 hours after discovery.
  • The 72-hour clock starts when the organization is reasonably certain that personal data has been affected.
  • It is better to file an incomplete initial notification on time and complete it later than to wait until you have all the answers.
  • In 2025, the CNIL received 6,167 breach notifications, half of them linked to hacking.
Yundera
Stay in control of your data
Yundera offers a managed private server in France, with your apps and data under your control, no technical skills required.

Table of Contents

What is a personal data breach?

A personal data breach is a security incident that compromises personal data. The GDPR (Article 4(12)), as restated by the CNIL, defines it as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of” personal data, or unauthorized access to that data.

The definition is broad. It covers any security incident, malicious or not, intentional or not, that affects one of these three properties:

  • Confidentiality: an unauthorized person accessed or received the data.
  • Integrity: the data was modified without authorization.
  • Availability: the data was lost, destroyed or temporarily inaccessible.

In practice, the most common situations are:

  • Hacking: the cause of half of the incidents reported to the CNIL in 2025, for example an intrusion following a phishing attack.
  • Ransomware: an attacker encrypts the files, sometimes after copying them. Ransomware has been the leading cause of reported hacks since 2018.
  • Misdirected email: an email containing personal data goes to the wrong recipient.
  • Lost or stolen equipment: an unencrypted laptop, USB drive or phone goes missing.

Pro tip: a simple human error also counts as a breach. Don't close it as “no further action” before you have assessed the risk and logged the incident in your register.

Do you always have to notify the CNIL of a data leak?

No. Notifying the CNIL is only mandatory if the breach poses a risk to the privacy of the people concerned. However, every incident must be recorded internally. The CNIL distinguishes three levels, and the obligations stack up from one level to the next:

  • No risk: the incident is logged in the internal breach register. There is no notification to the CNIL and no need to inform individuals.
  • Risk: in addition to the register, the CNIL must be notified “as early as possible and within 72 hours at most”.
  • High risk: register, notification to the CNIL within 72 hours, and informing the people concerned without undue delay.

To determine the level of risk, the CNIL recommends looking at several criteria:

  • Type of breach: loss of confidentiality, integrity or availability.
  • Nature and volume of data: health or banking data weighs more heavily than a list of business addresses.
  • Ease of identification: can the data easily be linked to a specific person?
  • Vulnerable individuals: children, patients, employees in a fragile situation.
  • Number of people affected: a handful of contacts or an entire customer database.

If in doubt, the guidance is clear: notify the CNIL, which will tell you whether you need to inform the individuals.

Pro tip: write down in the register why you chose a given risk level. If you decide not to notify, that justification is what will protect you during an inspection.

When does the 72-hour clock start?

The 72-hour period starts when you have a reasonable degree of certainty that a security incident has affected personal data. It therefore doesn't start at the first suspicious signal. According to the CNIL, the investigation time needed to establish the facts is not counted. That leeway is no excuse to wait: the analysis must be carried out quickly, and the clock starts as soon as the breach is established.

To meet this deadline without knowing everything, the CNIL provides for a two-stage notification:

  • Initial notification: sent as soon as possible, within 72 hours where feasible, with the information known at that point.
  • Follow-up notification: adds the number of people affected, the consequences and the measures taken as the investigation progresses.

If you go past 72 hours, notification is still mandatory, but you must explain the reasons for the delay. Waiting for the technical findings is a classic trap. The review of five years of GDPR lists this wait among the common causes of late notification, and only half of notifications were made on time.

Pro tip: as soon as an incident is confirmed, write down the exact date and time, who discovered it and the first known facts. This timestamp sets the starting point of the 72 hours and serves as evidence in the event of an inspection.

What should you actually do in the first 72 hours?

In the first 72 hours, you need to stop the leak, assess its severity, notify the CNIL if required and document everything, in that order. A four-step method helps you avoid missing anything under pressure:

Alarm clock representing the 72-hour deadline to report a data breach

  1. Contain and qualify: cut off the access involved (compromised account, public share, infected workstation) and change any exposed credentials. Keep logs and evidence without deleting them, then record the time of discovery.
  2. Assess the risk: identify the data affected, its volume, the people concerned and how vulnerable they are. Then classify the incident using the CNIL's three levels: no risk, risk or high risk.
  3. Notify the CNIL: if there is a risk, file an initial notification through the CNIL's online notification service, which is reserved for data controllers. Then complete it.
  4. Inform and document: notify the people concerned if the risk is high. Record the incident, your analysis and the measures taken in your breach register.

The hardest part often comes before those 72 hours even start: detection. According to the CNIL's review of five years of GDPR, half of breaches are discovered in under 10 hours. Yet it takes an average of 113 days to detect one. Some intrusions therefore go unnoticed for months, which drives that average up.

Pro tip: prepare a one-page incident response checklist now, with key contacts, access to the online notification service and a notification template. On the day of the incident, you'll save precious hours.

What must the notification and the breach register contain?

At a minimum, the notification to the CNIL must describe what happened, who is affected, the possible consequences, the contact person and the measures taken. The CNIL sets out this minimum content:

  • Nature of the breach: loss of confidentiality, integrity or availability, and the circumstances of the incident.
  • People and data concerned: categories and approximate number of individuals, categories and approximate number of records.
  • Likely consequences: identity theft, targeted phishing, financial loss, reputational damage, etc.
  • Contact: the data protection officer (DPO) or another person able to answer questions.
  • Measures taken or planned: to stop the breach and limit its effects.

The internal breach register contains the same information for every incident, including those that are not notified. In that case, it must also state why you decided not to notify.

Notification is done through the CNIL's online notification service, which is reserved for data controllers. The summary document you receive at the end serves as internal documentation.

Once submitted, you receive an acknowledgment by email. The CNIL reviews the notification within 24 business hours and only gets back to you if necessary. If you hear nothing within two months, it has no comments. It can also require that the people concerned be informed if this has not been done properly.

Pro tip: keep the register in a single, dated document, with one row per incident. An empty or missing register is a bad sign during an inspection.

When must you inform affected customers or employees?

You must directly inform your customers, employees or other people concerned as soon as the breach poses a high risk to their rights and freedoms (GDPR Article 34). According to the CNIL, this must be done as early as possible. It does not replace the notification to the CNIL: you need to do both.

The message, written in plain language, must include:

  • The nature of the breach: what happened and which data is affected.
  • The likely consequences: for example a risk of targeted phishing or identity theft.
  • A contact: the DPO or another person able to answer questions.
  • The measures taken and recommendations: what you have done, and what the person can do to protect themselves.

The GDPR provides three cases where informing individuals is not required:

  • Unintelligible data: the data was protected, for example by state-of-the-art encryption whose key was not compromised.
  • Risk neutralized: subsequent measures make the high risk unlikely to materialize.
  • Disproportionate effort: a public communication or equivalent measure then becomes mandatory.

To help victims, the CNIL and Cybermalveillance.gouv.fr published the resource “Personal data breach: what to do in 3 key steps” in October 2026. It takes the form of an action checklist running from the day of discovery to day 30.

Pro tip: attach this resource to your message to the people concerned. Your recommendations gain credibility and you'll get fewer calls.

What if the leak comes from a vendor or processor?

If the leak comes from a vendor, it is still up to you, as the data controller, to notify the CNIL and, if necessary, inform the individuals. The processor has its own obligation: according to the CNIL, it must report any data breach to you without undue delay. It can also notify the CNIL on your behalf if you arrange for it, but you keep your obligations and remain in charge of the decision.

This scenario is far from rare. In its 2025 annual report, the CNIL draws three lessons: no one is spared, breaches are increasingly massive and they often involve vendors. Its review of five years of GDPR also notes that a single attack on a vendor can trigger many notifications from its customers.

Three measures limit your exposure:

  • Contract clauses: require a short, specific reporting deadline, a dedicated contact and a list of the information to be provided.
  • Up-to-date inventory: keep a list of the vendors that host or process your personal data, along with their own subcontractors.
  • Fewer intermediaries: every additional SaaS tool adds a potential leak point and one more party to reach in the middle of a crisis.

Pro tip: check every year that the “incident” contact at your main vendors still responds. A bounced email on the day costs you hours out of the 72.

What are the risks of a late or missing notification?

Failing to notify, or notifying late without a legitimate reason, is a breach of the GDPR. The CNIL's review of five years of GDPR points out that this violation can lead to a fine of up to €10 million or 2% of turnover. On top of that come the risk of an inspection and reputational damage if people learn about the leak from the press rather than from you.

This risk is far from theoretical, including for small organizations:

  • Deadlines often missed: between May 2018 and May 2023, only half of notifications were made within 72 hours.
  • SMEs on the front line: the private sector accounts for about two-thirds of reports, and SMEs make up 39% of them.
  • Record volume: the CNIL received 6,167 breach notifications in 2025, 9.5% more than in 2024.
  • Targeted sanctions: in 2025, cybersecurity failings accounted for a third of inspections and nearly 30% of sanctions.
  • Stepped-up inspections: in 2026, the CNIL is devoting half of its inspections and enforcement actions to data security.

A timely notification, even an incomplete one, shows instead that the organization has the situation under control. A justified and documented delay is always better than silence.

Pro tip: if the deadline has already passed, notify immediately anyway and explain the reasons for the delay. Waiting longer only makes the violation worse.

Yundera: fewer intermediaries for your data

Consolidating your tools on a dedicated private server, rather than spreading them across many online services, reduces the number of third parties holding your data. The CNIL notes that breaches often involve vendors. The less scattered your data, the easier it is to know where it is and to respond within 72 hours. This doesn't eliminate the risk, and it doesn't exempt you from your obligations: in the event of a breach, you remain responsible for notifying the CNIL. On the attack side, our guide to ransomware in businesses covers the right reflexes.

Yundera

Yundera offers a managed private server, the Personal Cloud Server, hosted in France and dedicated to a single customer. Ready-to-use open source apps, such as file storage, photos, website hosting or office tools, install in one click from an app store. Each app is available on your own domain over HTTPS, with no static IP, no port forwarding and no manual certificate management. Your data stays on your server: Yundera doesn't collect it or sell it. No technical skills are required, since Yundera manages the server.

To compare plans and pricing, visit the Yundera private servers page.

Private server vs multiple SaaS tools — comparison diagram

The most common mistakes when facing a data breach

Most mistakes stem from a lack of preparation, not from the attack itself. The CNIL's review cites two main causes of delay: not knowing about the obligation to notify, and waiting for technical results before acting. The most common pitfalls are:

  • Waiting for all the answers: a partial initial notification is accepted.
  • Not dating the discovery: without that date, you can't prove you met the 72-hour deadline.
  • Forgetting the register: even a no-risk incident must be recorded in it.
  • Downplaying human error: an email sent to the wrong recipient is indeed a breach.
  • Overlooking vendors: their tools must appear in your data map.
  • Improvising: without a written procedure, every hour counts double.

Prepare these four things now:

  • Contacts: DPO, management, IT vendors.
  • Notification template: pre-filled with the sections required by the CNIL.
  • Breach register: a single, dated, up-to-date document.
  • Vendor list: who holds which data, and how to reach them.

— Yundera

Sources

Frequently Asked Questions

Does the 72-hour deadline include weekends and public holidays?

Yes. The GDPR sets the deadline in hours, not business days, so weekends and public holidays count. A breach discovered on a Friday evening should in principle be notified by Monday evening. If you miss the deadline, notify anyway and explain the reasons for the delay.

Is an email sent to the wrong recipient a data breach that must be notified?

It is indeed a data breach, because personal data was disclosed to an unauthorized person. It must always be recorded in the internal register. Notifying the CNIL is only mandatory if there is a risk to the individuals, which depends on the nature of the data, its volume and the recipient.

Do you need to notify the CNIL if the stolen data was encrypted?

If the data is protected by state-of-the-art encryption and the key has not been compromised, the risk is greatly reduced. In that case, informing the people concerned is not required. The incident must still be recorded in the register, and a notification to the CNIL is still necessary if some risk remains, for example a loss of data availability.

Who must notify the CNIL when the leak comes from a vendor?

The data controller, meaning the vendor's client organization. The processor must alert it without undue delay. It can notify the CNIL on the controller's behalf, but the controller keeps its obligations and the final decision.

How do you notify the CNIL of a data breach online?

Notification is done through the CNIL's online notification service, which is reserved for data controllers. You first file an initial notification with the known facts, then a follow-up notification. The summary you receive at the end serves as internal documentation.

Recommended Reading

분류 English
로그인 의견을 남기기