Reporting a data breach to the Data Protection Authority itself costs nothing: there is no fee or charge for it. The costs lie in what happens around it: finding out exactly what went wrong, informing the individuals affected, any necessary technical remediation work, and the time all of this takes from your organization. How much this amounts to depends heavily on the scale of the breach, the type of data, and whether you already had a process in place before things went wrong.
There is no fixed amount for "a data breach", because no two breaches are the same. An incorrectly sent email with contact details of one customer requires something different than a system intrusion with personnel files of a hundred employees. The cost items always fall into the same categories; only the scale differs.
Where the costs come from
The first cost item is internal time: someone must find out what happened, which data was affected, and whether the statutory 72-hour deadline for reporting to the Data Protection Authority is approaching. These hours are often underestimated, especially if there is no fixed point of contact or process and multiple people are looking at the same incident.
In addition, external help may be needed: an IT supplier who must technically close a breach, a forensic investigator for a larger intrusion, or a lawyer who reviews whether and how reporting should be done. Not every data breach requires all of these parties, but in a more serious incident these costs can quickly add up.
Informing the individuals affected also takes time and sometimes money: drafting a careful, understandable letter or email, answering the questions that follow, and in some cases offering a form of remediation, such as a new login code or free services. The decision tree on in a few questions shows whether and how you must report helps with getting the first step right, so you don't waste unnecessary time on uncertainty.
What determines the extent
The most important factor is the scale: how many people are affected and how sensitive is the data. A breach with names and email addresses weighs differently than a breach with financial data or health data. The EDPB guidelines and the GDPR itself mention these types of risk factors as a starting point for assessment, not as a formula for calculating an amount.
A second factor is how quickly the breach is discovered and how clear it is who is responsible for what. If a processor agreement already sets out which supplier must be notified and within what timeframe, that saves investigation work at the moment things go wrong. If that agreement doesn't exist, the incident itself takes more time to understand, before remediation even begins.
A third factor is whether your organization already has an established process: a fixed step-by-step plan, a list of who to notify, and a place where previous incidents are recorded. Without that, each incident requires reinventing who does what, which takes both time and calm at a moment when both are scarce.
The report itself is free, the preparation is not
It is good to keep this distinction clear: the obligation to report to the Data Protection Authority brings no costs with it, but being able to carry out that report properly does. Whoever must determine whether an incident needs to be reported within the statutory deadline, and what precisely must go in it, needs time for that. An overview of what belongs in a report and what documents you typically need to include is described in the knowledge base with explanations by topic.
Many of these costs are not one-time but recurring, simply because data breaches are not planned and can occur again even after years. That is why some organizations choose to have the clock, the steps and the recording run in a system instead of reconstructing this manually each time. What such a subscription costs and what you get in return can be seen on the pricing page with the breakdown per component.
Recording in advance saves effort later
The biggest cost saving is usually not in the incident itself, but in the preparation for it: a current processing record, clear agreements with suppliers and a fixed point of contact ensure that a data breach takes less time to assess and handle. Frequently asked questions about what is and is not required in this regard can be found on the page with answers to questions that other entrepreneurs also ask.
Would you like to get an initial picture of where you stand for your own situation? The free quick scan provides an indication in a few questions, without needing an account for that.