What should you do when a personal data breach happens?
Short answer
First contain the spread, then record the facts and assess the risk to individuals. If a risk is likely, you notify the supervisory authority within 72 hours of becoming aware; where the risk is high, you also inform the individuals themselves.
On this page
1.The first hours
Stop further spread of the data: revoke access, recall the wrongly sent email, change passwords, disconnect the compromised device. At the same time start recording: what happened, when it happened, when you noticed it, who reported it.
Immediately establish the scope: which categories of data are affected, how many people, and whether special category data is involved. All further decisions depend on these answers, so gather them first, not after a week.
2.Risk assessment
The risk is assessed for the people, not the organisation. The question is what harm could come to a person: identity theft, financial loss, discrimination, damage to reputation, inconvenience. What matters is the nature of the data, the volume, whether it was encrypted, and who could have accessed it.
Write down the decision and its reasoning immediately. If you decide not to report, the justification must be documented — explaining it later from memory will be difficult.
3.Notifications
If a risk to people's rights is likely, the breach must be reported to the State Data Protection Inspectorate within 72 hours of becoming aware of it. If not everything is clear by then, report what is known and add the rest later. Where the risk is high, the affected people must also be informed — in plain language, telling them what to do.
If the breach occurred at a processor, it must notify you without delay, and you, as the controller, submit the notification to the authority. For notification deadlines and content, see Article 33(1), (2) and (3) GDPR.
4.Log and conclusions
Every breach is recorded in an internal log, even ones that do not need to be reported: what happened, when, what the scope was, what measures were taken, and what the decision on notification was. This log is one of the first things an inspection looks at.
After every incident, write down one change that will reduce the chance of it happening again: narrower access, a double check before sending lists, encryption on portable devices. Without this step, the log remains just a history.
5.Prepare in advance
During an incident there is no time to work out who does what. A one-page plan — who to notify first, who assesses the risk, who drafts the notification, who talks to clients — cuts the response time from days to hours.
It helps to list supplier contacts in the plan in advance, since most incidents happen in their systems. If the contract sets a notification deadline, write it next to the contact.
Once a year, it is worth testing the plan with a short drill scenario: a list sent to the wrong person, a lost laptop, leaked login credentials. Half an hour of discussion is enough to make the gaps visible.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)