How do we tell people about a personal data breach, and what goes in the letter?

Notifying VDAI and telling the people have different thresholds:

So it often happens that VDAI must be notified and the people need not be. The reverse cannot happen in law: if the risk is high, notifying VDAI is always required.

To judge whether the risk is high, ask what bad thing could happen to the person. Recital 85 GDPR lists possible damage: identity theft or fraud, financial loss, discrimination, damage to reputation, loss of confidentiality of data protected by professional secrecy. The more sensitive the data, the more people, and the easier they are to identify, the higher the risk (EDPB Guidelines 9/2022, section IV).

When do we not have to tell people?

Article 34(3) GDPR sets out three exceptions:

1. The data was unintelligible to outsiders – e.g. protected with strong encryption before the breach, the encryption covered exactly the data affected, and the key was not compromised with them (point (a); paragraphs 78 and 97 of EDPB Guidelines 9/2022).
2. You have already removed the high risk – after the breach you took measures so that it is no longer likely to materialise (point (b)).
3. Telling everyone individually would take disproportionate effort – then, instead of individual letters, you make a public communication or use another measure that informs people equally effectively (point (c)).

If you rely on an exception, write down which one and why. All breaches, their facts, effects and remedial action must be documented (Article 33(5) GDPR), and if you have not told people yet, VDAI, having considered whether a high risk is likely, may require you to do so or may decide that an exception applies (Article 34(4)).

Article 34(2) GDPR requires the nature of the breach and at least the information in points (b), (c) and (d) of Article 33(3). In practice that is four blocks:

Paragraph 87 of EDPB Guidelines 9/2022 gives an example of useful advice: if login credentials were affected, reset the password. You may add more information than required.

Telling the person is free of charge (Article 12(5) GDPR), and the form must be concise, intelligible and easily accessible (Article 12(1)).

Our suggested text; replace the square brackets with your details.

Subject: Important: a data security breach at [company name] affecting your data

Dear [name],

On [date] we found that [what happened – e.g. an unauthorised person logged in to our customer account system]. The following data of yours was affected: [list of data]. [Data that was NOT affected, if it matters – e.g. the system holds no payment card data.]

What may happen. [Likely consequences – e.g. you may receive fraudulent e-mails in our name asking for your login details.]

What we have done. [Measures – e.g. we blocked access, changed passwords and notified the State Data Protection Inspectorate.]

What we recommend you do. [Concrete steps – e.g. change your password; if you use the same password elsewhere, change it there too; do not answer e-mails asking for login details.]

Who to contact. [Name], [e-mail], [phone].

We apologise for the inconvenience.
[Name and position of the manager]

Do not write statements you have not checked yet, e.g. that the data "was not published anywhere". If facts come out later, it is better to send a second letter.

Timing. The GDPR sets no number of hours – only "without undue delay". Recital 86 GDPR explains: for example, where an immediate risk of damage must be reduced, people should be told promptly, while the need to put in place measures against continuing or similar breaches may justify more time. The communication should be made in cooperation with the supervisory authority. If the police ask you to wait so as not to harm an investigation, you may delay, but people must still be told promptly afterwards (recital 88 GDPR; paragraph 95 of the EDPB Guidelines).

Channel. Paragraphs 89–92 of EDPB Guidelines 9/2022:

• send a dedicated message – not together with a newsletter or a routine notice;
• e-mail, SMS, an in-account message, post, or a prominent notice on your website all work;
• a press release or a blog post alone is not enough;
• if one channel will not reach everyone, use several;
• write in the language you normally use with the person;
• be wary of a channel compromised by the breach – impersonators could use it; if you can, choose another.

When reaching people individually is too hard. For example, the contact details were lost in the breach itself or you never had them (paragraph 97 of EDPB Guidelines 9/2022). In our view, a large number of people alone is not disproportionate effort if you hold their e-mail addresses or phone numbers. Then Article 34(3)(c) GDPR allows a public communication or another measure that informs people equally effectively.

Attach to the breach entry in your breach register:

• a copy of the letter sent and the date;
• the channel and the number of recipients;
• how many messages bounced or did not reach the person, and what you did about those people;
• if you did not tell people – which Article 34(3) exception you rely on and why.

This helps you prove you met the duty (Articles 5(2) and 33(5) GDPR; paragraphs 125 and 127 of EDPB Guidelines 9/2022).

Prepare this template now, before anything happens, and decide in advance who signs and who sends it. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities and which of your processes are risky – a breach in those processes is more likely to create a high risk for people.

Does telling people replace notifying VDAI?
No. They are two separate duties: VDAI under Article 33 GDPR, people under Article 34. Where the risk is high you need both, unless one of the Article 34(3) exceptions removes the duty to tell people.

Can we tell people by phone?
Article 12(1) GDPR provides for information in writing or by other means, including electronic means, and orally when the person asks for it. Our recommendation: even if you call, also send a written notice, because it is easier to prove.

The breach happened at our IT provider. Who tells the people?
You, as the controller. The provider, as a processor, must notify you without undue delay (Article 33(2) GDPR).

Can we wait until the investigation is over?
Only if there is a reason, e.g. a law-enforcement request not to hamper the investigation (recital 88 GDPR). If people can protect themselves, e.g. by changing a password, there is no reason to wait.

• What to do when a personal data breach happens? (in Lithuanian)
• We sent data to the wrong person – do we have to report it? (in Lithuanian)
• Breach register: what to record about every personal data breach
• Who handles data protection in the company: duties, appointment and a yearly calendar

The law and the risk: Personal data breach: when to notify VDAI and the people affected – dat.lt

• Duty to tell the people – Article 34(1) GDPR; content – Article 34(2) and Article 33(3)(b), (c) and (d); exceptions – Article 34(3)(a), (b) and (c); VDAI may require it – Article 34(4).
• Notifying VDAI – Article 33(1) GDPR; processor must notify the controller – Article 33(2); documentation – Article 33(5).
• Form and free of charge – Article 12(1) and 12(5) GDPR.
• Possible damage, timing and law-enforcement interests – recitals 85, 86 and 88 GDPR.
• Channel, language, a dedicated message – EDPB Guidelines 9/2022, paragraphs 87–92 and 95; encryption and disproportionate effort – paragraphs 78 and 97; evidence for an exception and for the communication – paragraphs 125 and 127.
• Accountability – Article 5(2) GDPR.

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda; EDPB Guidelines 9/2022, version 2.0. This text is general information and is not individual legal advice.