Can I handle a data breach myself?
Yes, you can do a large part of assessing and managing a data breach yourself. The GDPR does not require that a lawyer or external firm be engaged. What the regulation does require is that you identify the breach, assess whether it poses a risk to the individuals whose data has been affected, and — if it does — notify the Data Protection Authority in time and possibly the data subjects themselves.
Whether you can do this independently largely depends on the scale and complexity of the incident. A misdirected email containing one customer's data is different from a hacked server with thousands of customer files. The line between doing it yourself and outsourcing is not set by law, but by your own ability to quickly and carefully assess what has happened.
What you can assess yourself
The first question in any incident is whether there is actually a data breach within the meaning of the GDPR: have personal data been lost, accessed by someone who had no right to do so, or accidentally altered or destroyed? You can make that assessment yourself using a clear checklist. see in a few questions where you stand gives an initial indication without you needing an advisor right away.
If there is indeed a breach, the risk assessment follows: does it pose a risk to the rights and freedoms of the data subjects, for example because sensitive data is exposed or identity fraud becomes possible? For many common situations, you can also make this assessment using the guidelines of the EDPB and the guidance provided by the Data Protection Authority. The knowledge base with explanations by topic describes the criteria that play a role, with references to the official text.
Actual notification to the Data Protection Authority is also something many organizations can do themselves in practice. The supervisory authority has its own notification form for this, and the information requested — what happened, which data is involved, how many people are affected, and what measures have been taken — is information that your organization knows best itself.
When it is wise to seek additional help
In a number of situations, handling it yourself becomes more difficult. If it involves a large number of data subjects, sensitive personal data such as health data, or a technical incident where the extent is still unclear, it is advisable not to rely solely on your own assessment. The same applies when the breach may also have consequences in another Member State, or when it is unclear which supervisory authority is competent.
Notifying the data subjects themselves — rather than just the supervisory authority — also requires care. The tone, content and timing of that communication partly determine how people respond, and a poorly worded message can cause more concern than the incident itself. In those cases, it is wise to consult a lawyer or contact the Data Protection Authority for the appropriate course of action.
What the GDPR does and does not require
The regulation prescribes a deadline within which a notifiable breach must be reported to the supervisory authority, and it requires organizations to document which data breaches have occurred, including breaches that do not need to be reported. What the GDPR does not prescribe is who carries out that process within your organization. This means that handling it yourself is permitted, as long as the result meets what the law requires.
Responsibility remains with the organization, even if part of the work is outsourced to an advisor or agency. It is therefore not a matter of handing everything over and forgetting about it, but of knowing which steps have been taken and why.
Documentation is always required
Whether you do it yourself or have it supported, documentation is needed in both cases: what happened, when you discovered it, what assessment you made of the risk, and what measures were taken to prevent recurrence. That documentation is not only useful for the supervisory authority, but also for yourself, should a similar incident occur again later.
How that substantiation should look and which sources are used for it can be read on the page where the information comes from. If you are uncertain whether your situation is subject to notification, first do the free check and read the relevant topics in the knowledge base before making a decision. If you want to bring the process of identification to resolution into order structurally, you can register for a business account to have the deadlines and documentation run automatically.