The obligation with a stopwatch
Most PDPA duties are things you build calmly in advance. Breach response is the one you execute under pressure - which is exactly why you rehearse it in advance. The whole regime comes down to a sequence you can memorise: contain it, assess whether it is notifiable within 30 days, notify the PDPC within 3 days if it is, tell affected individuals, then learn from it. Know the sequence cold and a bad day stays a manageable one.
Assess, then notify 9 min live
The regime is a timeline. From the moment you have credible grounds a breach occurred, you assess whether it is notifiable; if it is, the PDPC clock and then the individuals clock start. Get the sequence and the numbers right and the rest follows.
LiveWhen is a breach notifiable?3 min▶
Not every breach is reportable. A breach is notifiable if it meets either limb of a two-part test:
- Significant harm. It is likely to result in significant harm to the affected individuals. Certain categories of personal data are prescribed as automatically meeting this bar in the PDP (Notification of Data Breaches) Regulations 2021.
- Significant scale. It affects 500 or more individuals - regardless of how sensitive the data is.
Either limb is enough. "Significant harm" includes physical, psychological, emotional, economic, financial, and reputational harm - so a small leak of the wrong kind of data can be notifiable even if it touches only a handful of people.
LiveThe two timelines3 min▶
The numbers are the part you must not fumble under pressure. There are two clocks:
- Assess within 30 days. Once you have credible grounds that a breach occurred, take reasonable and expeditious steps to assess whether it is notifiable - within 30 calendar days.
- Notify the PDPC within 3 calendar days. If you decide it is notifiable, notify the PDPC as soon as practicable, and in any case no later than 3 calendar days after you make that determination.
- Then notify affected individuals as soon as practicable - at the same time as, or after, notifying the PDPC (never carelessly before, so you do not cause panic without facts).
| Milestone | Deadline |
|---|---|
| Assess whether notifiable | Within 30 calendar days of credible grounds |
| Notify the PDPC | No later than 3 calendar days after deciding it is notifiable |
| Notify affected individuals | As soon as practicable, at the same time as or after the PDPC |
Self-studyIf you are a data intermediary3 min read▶
A data intermediary - an organisation that processes personal data on behalf of and for the purposes of another - has a narrower but firm duty. If it detects a breach in the data it processes, it must notify the organisation it processes for, without undue delay. The intermediary does not assess or notify the PDPC itself; that responsibility sits with the organisation whose data it is.
Intermediary detects a possible breach in the data it handles for a client.
It notifies that client organisation without undue delay - the client's assessment clock effectively depends on this.
The organisation assesses, and if notifiable, runs the PDPC and individual notifications.
If you use vendors, make sure your contracts require them to tell you fast. Their delay becomes your missed deadline.
Contain, notify well, learn 9 min live
The clock is only half the job. Around it sits a response arc that starts before the assessment and ends after the notification: contain the damage, assess, notify well, remediate, and feed what you learned back into your controls so the same gap cannot reopen.
LiveWhat a notification must contain3 min▶
A notification is not a one-line "we had a breach". Both the PDPC and the individuals need enough to understand and act. Aim to include:
- What happened - the nature and extent of the breach, and when it was discovered.
- What data was involved and roughly how many individuals are affected.
- The likely harm and what you have done or will do to contain and remediate it.
- What individuals can do to protect themselves (change a password, watch for scams) and how to contact you with questions.
Notify the PDPC through its breach notification form. If you do not yet have every detail within the deadline, notify anyway with what you have - you can supplement later.
LiveWhen to consult the PDPC first3 min▶
Usually you notify individuals at the same time as or shortly after the PDPC. But in some cases you should consult the PDPC before notifying individuals - for example, where notifying could tip off a perpetrator, interfere with an investigation, or where the breach is likely to attract widespread public attention and a coordinated message matters.
Marina has a leak of 3,000 records. A misconfigured export exposed name, email, and order history for 3,000 customers. Scale alone (500+) makes it notifiable - Marina does not even need to argue about harm. The team contains it (revokes the export link), assesses well inside 30 days, notifies the PDPC within 3 days of confirming it is notifiable, then emails the 3,000 customers with plain steps: what leaked, that no passwords or cards were involved, and how to reach the DPO. One rehearsed sequence, no scramble.
LiveTurn the incident into a fix2 min▶
The notification is not the finish line. A breach is direct evidence that a control failed - so the last step is to use it. Trace the incident to the Protection Obligation gap that allowed it (a misconfiguration, an over-broad access right, a missing review) and close that gap, then check whether the same weakness exists elsewhere.
Run Marina's breach clock ★ 10 min
A leak is discovered on a Monday. Walk the clock forward and write down what must happen and by when - this is the drill you want to have done before it is real.
Monday - credible grounds. The export link is found exposed. Contain it first: revoke access, preserve logs. Note the date - your 30-day assessment clock starts now.
Assess. How many individuals, what data, what harm? With 3,000 records the scale limb settles it - notifiable. Write the determination date; the 3-day PDPC clock starts from there.
Notify the PDPC. Within 3 calendar days of the determination, file the notification with what you know. Then plan the individual notifications - same time or just after.
Remediate and learn. Fix the misconfiguration, check for the same weakness elsewhere, and feed the lesson back into your Protection controls. Reflect - if this happened tomorrow, who is your incident lead, and do they know it?
Before session b8 ◐ 40 min total
- Sketch your organisation's breach clock: who declares a breach, who assesses, who notifies, and where the 30-day and 3-day deadlines are tracked.
- Name your incident lead and their backup. Does the wider team know who to call at 9pm on a Friday?
- Check one vendor contract: does it require the vendor to notify you of a breach without undue delay?
- Read: PDPC Guide on Managing and Notifying Data Breaches, plus the prescribed categories in the PDP (Notification of Data Breaches) Regulations 2021.
Official sources covered
Taught from the PDPC's own breach guidance. This page covers the working core of the notification regime - the prescribed data categories and edge cases live in the regulations linked below.
Three questions before you go 🎯 ◐ 90 seconds
1 · A data breach is notifiable to the PDPC if it...
Either limb triggers notification: significant harm to affected individuals, OR significant scale of 500 or more individuals. You do not need both.
2 · Once you determine a breach is notifiable, you must notify the PDPC...
You have up to 30 days to assess whether it is notifiable; once you decide it is, the PDPC must be notified no later than 3 calendar days after that determination.
3 · A data intermediary detects a breach in data it processes for a client. It must...
The intermediary's duty is to alert the organisation it processes for, without undue delay. That organisation then assesses and, if notifiable, handles the PDPC and individual notifications.