Personal data breach in Poland: what should a business do within the first 72 hours?

What qualifies as a personal data breach?

The GDPR definition covers a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It is therefore broader than a data “leak”.

Examples include:

A server failure that does not involve personal data is not dealt with under the GDPR breach regime. Conversely, restoring a database from backup does not automatically close the matter. The controller still needs to assess any loss of availability, unauthorised access or other effect on the data.

• sending an email or attachment to the wrong recipient;
• compromise of an employee mailbox containing customer correspondence;
• loss of an unencrypted laptop or storage device;
• ransomware that makes personal data unavailable;
• accidental deletion of the only copy of a database;
• exposure of a file through a misconfigured public link;
• unauthorised alteration of records.

When does the 72-hour period begin?

The clock does not necessarily start with the first technical alert. Under the EDPB approach, a controller becomes aware when it has a reasonable degree of certainty that a security incident has occurred and personal data has been compromised.

This does not allow an organisation to defer its preliminary investigation. If credible evidence indicates on Monday that an employee mailbox was compromised, the organisation should promptly establish whether it contained personal data and whether an unauthorised person could access it. An internal policy that waits for the next weekly board meeting cannot extend a statutory deadline.

Where the business processes data on behalf of a customer, it must notify the controller without undue delay. The controller decides whether a supervisory-authority notification is required. The DPA should provide for an immediate escalation channel, the minimum content of the first report and phased updates. The distinction is explained further in Data processing agreements in Poland: when is a DPA required?.

What should the business do immediately?

The response should combine technical, operational and legal work. Incident containment and the GDPR assessment should run in parallel.

The business should:

Deleting emails, wiping logs or restoring a system without preserving evidence can make it harder to determine the breach’s scope and demonstrate a compliant response.

• appoint a coordinator and record when the initial information was received;
• contain the threat, for example by disabling an account or revoking access;
• preserve logs, messages, configurations and other evidence;
• establish whether it acts as controller, joint controller or processor;
• identify the affected systems, data categories, groups of people and likely scale;
• assess the possible consequences for those people;
• keep a chronology of facts, decisions and remedial action.

How should risk to individuals be assessed?

The number of records is not decisive. A breach affecting one person may create a high risk if it exposes health information, identity documents, passwords, financial circumstances or information that could facilitate blackmail or identity theft.

Relevant factors include:

A mistaken recipient’s assurance that an email has been deleted may reduce the risk, but does not replace an assessment of the attachment, the recipient’s reliability and the possibility that the information was retained or forwarded.

• the nature and sensitivity of the data;
• how easily individuals can be identified;
• the number of people and the range of data relating to each person;
• who obtained or may have obtained access;
• whether effective encryption or pseudonymisation was in place;
• possible financial, social, professional or personal consequences;
• whether vulnerable individuals such as children, employees or patients are affected;
• whether the breach is continuing and whether its effects can be mitigated.

When must the Polish supervisory authority be notified?

The controller must notify the breach unless it is unlikely to result in a risk to individuals’ rights and freedoms. Notification is therefore not limited to cases involving a high risk.

The notification must include at least the nature of the breach, where possible the categories and approximate numbers of individuals and records concerned, the contact details of the data protection officer or other contact point, the likely consequences and the measures taken or proposed to address the breach.

Where all details are not yet available, the GDPR allows information to be provided in phases without undue further delay. A notification submitted after 72 hours must explain the delay. A late notification should not simply be omitted.

When must affected individuals be informed?

Individuals must be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The communication should use clear and plain language and explain the breach, its likely consequences, the organisation’s response and the steps the recipient can take.

The GDPR provides exceptions. Individual communication may not be required where the data was protected in a way that makes it unintelligible to an unauthorised person, subsequent measures have removed the high risk, or contacting each person would involve disproportionate effort. The last scenario requires an effective public communication or similarly effective measure.

The message should not be drafted solely as a reputation-management exercise. It should tell recipients whether they should change a password, block an identity document, monitor an account, be alert to phishing or contact a particular organisation.

How should a business prepare before an incident?

Delays often result not from a missing form, but from unclear roles, incomplete system and supplier inventories, and the absence of decision-makers outside ordinary office hours. A procedure should define the reporting channel, deputies, escalation criteria, evidence preservation and templates for the breach register, regulatory notification and individual communications.

A GDPR audit can identify gaps, but the procedure should also be tested against a realistic scenario. A tabletop exercise reveals whether IT can determine scope promptly, supplier agreements produce timely information and decision-makers receive the facts needed for a risk assessment.