Question
Clearly sourced
Expert knowledge for digital decisions
What to do in case of a data breach in the CRM?
Short answer
Immediately contain, document, and assess. If there is a risk to affected individuals, the supervisory authority is generally to be informed within 72 hours (Article 33 GDPR). In cases of high risk, affected individuals must also be informed. The deadline runs from the moment of knowledge, not from the clarification of the cause.
The First Steps
- Contain. Lock access, change passwords, remove the affected system from the network if necessary.
- Document. What happened, when it was noticed, which data, how many individuals, which measures. Starting from the first minute.
- Assess. Does a risk exist for the rights and freedoms of affected individuals?
- Report, if yes – generally within 72 hours.
- Inform affected individuals in cases of high risk.
What Constitutes a Data Breach
Not only a hacker attack. Also:
- An email containing customer data sent to the wrong recipient
- A lost laptop without encryption
- An export that was accidentally publicly accessible
- A former employee with still active access
The last case is more common than all others combined.
The 72 Hours
They run from the moment the incident becomes known to you – not from the moment you understand it. An incomplete report that is later supplemented is permissible and better than a delayed one.
What Should Be Prepared in Advance
- Who decides on a report? (Not clarified in an emergency.)
- Which supervisory authority is responsible?
- Is there a template for documentation?
- Are log data available at all to determine the scope?
The last point often determines whether a report is fact-based or a guess.
This text does not replace legal advice.
Key facts
- Reporting Deadline
- Generally 72 hours from knowledge (Article 33 GDPR)
- Most Common Cause
- Active access by former employees
- Prerequisite
- Log data to determine the scope
Sources
All external claims are backed by traceable sources.- 01