Three hours after a server crash, your legal obligation might already be ticking down.

Under the General Data Protection Regulation (GDPR), a data breach notification is not optional. It is a binding, time-sensitive duty. If you control or process personal data, you must notify the relevant supervisory authority within 72 hours of becoming aware of a breach—unless you can prove the breach is unlikely to risk the rights and freedoms of individuals. Delay without justification can mean heavy penalties and lasting damage.

A GDPR data breach is more than a hacker stealing passwords. It can be accidental loss, unauthorized disclosure, or any unlawful access to personal data. The scope covers everything from misdirected emails to compromised databases. Any incident involving personal data must be assessed quickly. The notification rules exist to protect data subjects, ensure transparency, and enforce accountability.

The notification to authorities must include the nature of the breach, categories and number of individuals affected, categories and number of personal data records involved, contact details for your data protection officer, and the likely consequences. You must also describe the measures taken or planned to address the breach and reduce harm. If full details are not available immediately, you can provide information in phases, but the clock runs from the moment you are aware.

If the breach is likely to result in a high risk to individuals’ rights and freedoms, you must also inform those individuals without undue delay. Clear language is required—no legal smokescreens. People must understand what happened, what it means for them, and what steps they should take.

Failing to follow the GDPR breach notification requirements can lead to administrative fines of up to €10 million or 2% of global annual turnover, whichever is higher. But the bigger cost is trust. A slow or incomplete response can erode user confidence far more than the breach itself.

This is why monitoring, logging, and real-time detection matter. You cannot manage the 72-hour limit if you discover breaches late or track them poorly. Efficient breach handling demands clear processes, automated alerts, and precise record-keeping.

See how fast you can go from breach detection to fully documented GDPR-compliant notifications with Hoop.dev. Run it, connect your systems, and watch in real time how it handles the critical first minutes. You could see it live before your coffee cools.