Author: Kohei Kurihara, Privacy Expert
[Disclaimer] This article reflects the author's personal views, and the author is not a licensed attorney. Please note that it is not intended as legal advice.
Introduction
The GDPR (General Data Protection Regulation) imposes a very strict reporting obligation commonly known as the "72-hour rule." Given the recent rise in data breaches, companies need not only to file accurate reports with authorities, but also to understand in advance the factors that could become risks.
*In Europe, a review of the GDPR is also being discussed as part of the Digital Omnibus proposal, which aims to overhaul the EU's complex digital regulations. A joint opinion submitted on February 11, 2026 by the European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB) included a statement supporting an extension of the 72-hour deadline to 96 hours, so the practical reporting deadline may change in the future.
To report within a limited time, rather than considering how to deal with risks after the fact, you need to identify potential risks in advance and assess them—including whether your company can handle them on its own.
What Exactly Is the GDPR's 72-Hour Rule?
Article 33 of the GDPR requires companies to report a data breach to the relevant data protection authority within 72 hours of becoming aware of it. Because of this short "72-hour" reporting window, it has come to be called the "72-hour rule."
Before the GDPR was enacted in May 2016, companies were encouraged to report data breaches under the European Data Protection Directive adopted in October 1995.
However, some laws applying to telecommunications providers imposed reporting obligations on specific companies, and some countries, such as Ireland, required Codes of Practice. Even within Europe, breach reporting had not been established as a uniform corporate responsibility.
Since the GDPR took effect, when a breach occurs, companies must report not only to regulators but also to the affected individuals when the breach may infringe on their rights. When a high-risk breach occurs, not only the company but also the individuals whose data was leaked may suffer secondary or even tertiary harm, such as scam phone calls.
For this reason, companies must not stop at reporting to regulators; they must also notify individuals so that those individuals can take steps to avoid risks themselves.
The reason the reporting obligation is set at such a short 72 hours is that companies are expected to communicate the necessary information in their reports so that individuals, in particular, can understand the risks through the company's notification and, in some cases, avoid or minimize them.
So far, we have explained the "72-hour rule" along with the background behind the reporting obligation. To achieve accountability, measures taken before a breach remain extremely important for companies, but the response after data has been leaked is now also strictly required.
The Response Procedure Required When a Breach Occurs
So, assuming a breach has occurred, how should a company respond?
In April 2023, the European Data Protection Board (EDPB) published guidelines and a summary document on the procedure for reporting breaches. The summary document clearly explains the breach reporting procedure companies should follow.
The diagram below shows the internal review process, created by the author based on the EDPB's publications.
Steps to take when a breach occurs: Phase 1
Record the breach in documentation (breach register)
- First, the company needs to recognize that a breach has occurred internally. To do so, record what kind of breach occurred within the company, the measures the company has taken, and the risks that may arise.
Assess whether the breach poses a risk of infringing on individuals' rights
- The Article 29 Working Party—the predecessor of today's EDPB—classified breaches into three types in guidelines adopted in October 2017. Organize the risks that have arisen according to the guidelines' classification and assess them.
Steps to take when a breach occurs: Phase 2 (if the leaked data is high-risk)
Report to the relevant regulator, even if you don't have all the information at the outset
- If the leaked data turns out to be high-risk, you must report to the relevant regulator. The EDPB maintains a list of each country's regulator reporting contacts on its website, so file your report via the appropriate contact or form.
*Many countries in Europe use online forms for breach reporting, but depending on the preferences of each country's regulator, reporting content may come to differ from country to country. For now, we recommend organizing the situation according to the formats and templates published by the EDPB (discussed below) and preparing an internal process that allows you to report.
Assess whether the breach poses a very high risk of infringing on individuals' rights
- At the same time, beyond the fact of the leak itself, you need to assess whether the leaked data poses a risk of infringing on individuals' rights. The guidelines on breach notification set "a high risk to the rights and freedoms of individuals" as the threshold for notification.
Steps to take when a breach occurs: Phase 3 (if the risk to individuals is high)
Notify individuals promptly
- If the risk assessment finds "a high risk to the rights and freedoms of individuals," you must notify the affected individuals through appropriate means such as SMS or direct mail so that they can understand the risks they may face due to the breach.
That covers the flow of response steps a company should take when a breach occurs.
What Penalties Can Apply If Breach Reporting Is Late?
For those involved in day-to-day corporate compliance, even once you understand the steps to take in a breach, you probably wonder what penalties you might face if your breach report is late or you fail to meet other obligations.
Here, we introduce as a reference case the penalty imposed in Norway on the US company Argon Medical Devices.
In this case, although the company was required to report within 72 hours of discovering the breach, it did not report for 67 days, and was ultimately fined 2.5 million kroner (about 42.6 million yen).
It began with a cyberattack between May 21 and June 14, 2021, which leaked employee data in Europe, including Norway. The attack resulted from an unauthorized third party gaining access to employee data, but when the attack was discovered on June 14, the company investigated on the assumption that only its US headquarters was affected.
Later, during the investigation, it was found on July 19 that a breach had also occurred within Europe. The company then carried out a breach assessment in line with the GDPR, and its final report ended up being filed on September 24.
The Norwegian regulator continued to request additional information after July 19, but because the company ultimately filed its report on September 24, the fact that it had far exceeded the 72-hour deadline became the central issue in deciding whether to impose a fine.
From a practical standpoint, this case offers the following lessons.
- Design proper procedures for understanding breaches and for reporting them
- The company had designed its procedure so that breach reports were filed only after the full situation had been understood. Even though it should have filed the necessary report within the limited 72-hour window, its internal structure was not designed to comply with the regulation.
- Continue reporting on the breach while implementing countermeasures
- By reporting within 72 hours, a company can obtain necessary information from the regulator, and both sides can share an understanding of the current situation.
- Understand that even companies outside Europe can create risks for individuals when European individuals' data is leaked
- Complying only with US or Japanese law may result in late breach reports, so implement measures using procedures aligned with regional regulations.
We presented this as a case of a US company violating the GDPR, but particular care is needed when your headquarters or main operations are outside Europe and decisions for the European region are made by headquarters, because your breach reporting response may fall behind.
Check the Reporting Template Published by European Authorities
So far, we have covered the response procedure when a breach occurs and a case in which a fine was actually imposed. For practitioners, the biggest headache when a breach occurs is probably knowing what to include in the report.
From June 10 to August 5 this year, the EDPB is seeking public comments on a template for reporting to regulators in each European country. (It has not yet been formally adopted, and updates are expected after gathering feedback from national regulators.)
This template (as published for public comment on June 10, 2026) consists of 126 items across 7 sections, and describes whether each item is required to be reported.
The table below summarizes what should be included for each of the 7 sections.
| Section | What to include |
|---|---|
| 1. Information required when reporting a breach | State whether the breach report is an initial report or an additional or final report. Also include the report ID the regulator needs to cross-reference past reports. |
| 2. Information on the data controller and the reporter | Provide information on the reporting company and the industry and business it belongs to. Also include information on the person responsible for the report. |
| 3. Initial information required for the breach report | Describe in detail the date and time of the breach, the data involved, the circumstances of the leak, and so on. If the cause of the breach is known at the initial reporting stage, also include information on the circumstances of the breach, the resulting damage, and the affected individuals. |
| 4. Additional information required for the breach report | Describe the results of a risk assessment of the impact the breach may have on affected individuals. Also describe the measures to be taken if a breach occurs in the future. |
| 5. Communication with individuals whose data was leaked | Where individuals' rights may be infringed, describe how you are communicating with those individuals and what you are doing. |
| 6. Other issues | If you are also reporting to bodies other than data protection regulators, describe that as well. If the breach spans multiple countries, also describe the cross-border situation. |
| 7. Supporting attachments | Attach materials proving the breach occurred, records of email correspondence with affected individuals, and so on. |
Looking at the template's items, you can see that it separates initial and ongoing response while also requiring a description of how individuals are being handled. In practical terms, companies need to build a structure that lets them grasp the impact of a breach as early as possible and report to all relevant parties.
In addition, so as not to overlook required items when reporting additional information, you need to understand the reporting items in advance and, in normal times, build a structure that allows you to quickly grasp the situation if a breach does occur.
We have covered the GDPR's "72-hour rule" and how to respond in practice. Even Japanese companies must comply with local regulatory requirements when the affected individuals are in Europe, so we recommend starting by reading through the template and reviewing how well your company's breach reporting structure is in place.
References
- Legal framework of EU data protection
https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en - Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:31995L0046 - DATA PROTECTION (AMENDMENT) ACT 2003
https://www.irishstatutebook.ie/eli/2003/act/6/enacted/en/pdf - Recital 85 EU GDPR
https://www.privacy-regulation.eu/en/recital-85-GDPR.htm - Guidelines 9/2022 on personal data breach notification under GDPR
https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en - Guidelines on Personal data breach notification under Regulation 2016/679
https://uk.practicallaw.thomsonreuters.com/Link/Document/Blob/I6dbee103362011e99687ad62ac048e9b.pdf - Notify a data breach
https://www.edpb.europa.eu/contact/notify-a-data-breach_en - Guidelines 9/2022 on personal data breach notification under GDPR
https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en - Recital 88 EU GDPR
https://www.privacy-regulation.eu/en/recital-88-GDPR.htm - American company fined 2.5 million NOK for failure to notify the Data Protection Authority within 72 hours
https://norway.dlapiper.com/en/news/american-company-fined-25-million-nok-failure-notify-data-protection-authority-within-72-hours - Template for personal data breach notification
https://www.edpb.europa.eu/public-consultations/template-for-personal-data-breach-notification_en - The new EDPB template for personal data breach notification: simplification of breach reporting?
https://www.timelex.eu/en/blog/new-edpb-template-personal-data-breach-notification-simplification-breach-reporting - EDPB-EDPS JOINT OPINION 2/2026
https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-22026-on-the-proposal-for-a-regulation-as_en
About the Author
Kohei Kurihara, Privacy Expert
Worked in a politician's office while at university, then joined Rakuten after graduating. After two years in sales, he started his own business, helping overseas digital services expand into Japan and Japanese services expand abroad. Since 2017, he has served as the Japan representative of the Government Blockchain Association, a US nonprofit.
While involved in founding startups, he has spoken on blockchain at international conferences, including UNESCO events. In 2020, he launched the Privacy by Design Lab (a general incorporated association), working to build international forums centered on privacy advocacy. His areas of expertise are data protection (personal information protection), digital marketing, and blockchain. He runs "Privacy Talk," an interview media outlet featuring direct conversations with privacy industry leaders in Japan and around the world.