The mistake: waiting until everything is clear
The most common mistake when reporting a data breach is not the breach itself, but the moment an organization decides to report. Many companies want to know exactly what happened, which data is involved, and how many individuals are affected before notifying the supervisory authority. That feels thorough, but the GDPR asks for something different: the 72-hour reporting deadline starts running as soon as you become aware of the data breach, not once you have all the facts in order.
The consequence is that the clock has already run down significantly by the time everyone internally agrees on exactly what happened. This is usually not a matter of unwillingness, but of unfamiliarity with how that deadline works: the GDPR allows a report to be supplemented in stages, precisely because complete certainty is often impossible to obtain within three days.
Why this mistake occurs so often
The confusion arises because people conflate a data breach and a reportable data breach. Not every incident involving personal data must be reported to the supervisory authority; the GDPR distinguishes based on whether there is a risk to the rights and freedoms of the data subjects. Companies that have not drawn that distinction clearly often go too far in two directions: they report almost nothing out of fear of hassle, or they try to get the full picture first before daring to make a report. Both reactions stem from uncertainty about what the law precisely requires, and that uncertainty can often be largely eliminated by asking a few fixed questions. The decision tree on in five questions shows where you stand was created for that purpose: it shows based on a few concrete questions whether an incident likely falls under the reporting obligation, without you needing legal knowledge beforehand.
A second mistake that often goes with it
Closely related to reporting too late is the failure to maintain your own records. Even a data breach that you ultimately do not report to the supervisory authority should be recorded internally: what happened, why you did or did not report, and what measures were taken. Many organizations only register incidents they actually reported and leave the rest undocumented. This means you are missing precisely the overview needed to demonstrate that a decision was made consciously and on the basis of the correct criteria, should that be asked of you later.
How to make the clock work for you
The 72-hour deadline is not intended to catch organizations off guard, but to enable data subjects to be warned quickly if necessary. This works better if it is clear beforehand who within the organization reports a suspected breach, to whom, and what basic questions should be routinely asked. Without those agreements, valuable time is lost figuring out who is actually responsible, while the clock is already running.
It also helps to know in advance which systems and vendors process personal data, so that when a vendor reports a breach, you can immediately assess which data and which data subjects are involved. A current overview of the SaaS tools used and the agreements concerning them, as reflected in the processing register on the knowledge base with explanations by topic saves considerable investigative work in practice when it matters.
What you can establish beforehand
The core point is that a report does not need to be complete to be timely. An initial report with the known facts, followed by a supplement once more becomes clear, is within what the GDPR allows. Organizations that know this beforehand and have a fixed, brief procedure for it are less likely to fall into the mistake of waiting too long. What also helps with this is clarity about where sensitive data is stored and how it is secured, so that a suspected breach can be assessed more quickly for severity; the page on how data is protected within the system provides insight into that.
Whether a specific incident at your organization is subject to mandatory notification and how best to document it is ultimately a decision you make yourself, possibly with a lawyer or in consultation with the Dutch Data Protection Authority. gdpria.eu provides clarification and a structured initial assessment, not legal advice.
Would you like to know where the key points of attention are for your organization? The free quick scan and the answers to frequently asked questions provide an initial overview within a few minutes, without requiring an account.