Personal data breach: 72 hours to notify and what you must document

If there is a personal data breach — a lost laptop, an e-mail sent to the wrong person, a ransomware attack — the controller must notify the Personal Data Protection Office of the Slovak Republic (Úrad na ochranu osobných údajov SR) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people. Where the risk is high, the people affected must also be informed. Every breach must be documented.

Key points

Notification to the supervisory authority: without undue delay and, where feasible, within 72 hours of becoming aware (Article 33(1) GDPR).

No notification is needed if the breach is unlikely to result in a risk to people’s rights and freedoms.

Where the risk is high, the data subjects must also be informed without undue delay (Article 34).

Every breach — including those not notified — goes into the internal register (Article 33(5)).

A processor must inform the controller without undue delay (Article 33(2)).

The Digital Omnibus proposal would extend the deadline to 96 hours; it has not been adopted.

What a personal data breach is

The GDPR takes a broad view: it is a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data, or unauthorised access to it. It does not have to be a hacking attack. Typical cases in small businesses:

an e-mail with an attachment sent to the wrong person, or a group e-mail with visible addresses,
a lost or stolen phone or laptop without encryption,
ransomware that has encrypted the customer database,
a publicly accessible folder in the cloud.

Decision procedure

Detection. The 72 hours run from the moment the controller becomes aware of the breach.
Risk assessment. What data, how many people, can they be misused? Are they encrypted?
No likely risk → you do not have to notify, but you record the breach in the register together with the reason for not notifying.
Risk → you notify the Personal Data Protection Office of the Slovak Republic within 72 hours. If you do not yet know everything, you can notify in stages.
High risk → you also inform the people affected in clear and plain language. Exceptions apply, for example, where the data were unintelligible (encrypted).

What the notification must contain

Under Article 33(3) GDPR, at least:

the nature of the breach, the categories and approximate number of data subjects and records concerned,
the contact details of the data protection officer or another contact point,
the likely consequences,
the measures taken or proposed to address and mitigate the breach.

The link with cybersecurity

If your company is an operator of an essential service under Act No. 69/2018 Coll. on cybersecurity, a cyber incident may at the same time trigger an obligation to report it to the National Security Authority (Národný bezpečnostný úrad — early warning within 24 hours, notification within 72 hours) and amount to a personal data breach under the GDPR. These are two separate processes with different recipients.

What may change

In its Digital Omnibus proposal of 19 November 2025, the European Commission proposed extending the deadline to 96 hours and notifying only breaches involving high risk. The proposal has not been adopted — until then, the 72-hour deadline applies.

What to do

Decide who in the company decides on notification and who submits it — before anything happens.

Prepare a template record: what happened, what data, how many people, consequences, measures taken.

Agree in your processor contracts how quickly they will inform you of an incident.

If you also fall under the Cybersecurity Act, align the process with incident reporting to the NBÚ (24/72 hours).