Report a data breach to the Belgian DPA: a practical guide

A misaddressed payslip, a stolen device or an inaccessible customer database first calls for facts. Record what you know for certain and what is still being investigated. A loss of availability of personal data can also be a personal data breach; a backup or encryption does not automatically make an incident harmless.

1. Note the moment the incident was discovered and when you had sufficient certainty about the personal data breach.
2. Appoint one coordinator and a deputy. Agree who follows up on technical matters, communication and legal assessment.
3. Limit further access or spread together with your IT partner. Carefully preserve relevant logs and evidence.
4. Determine your role: controller, processor or another role. A processor notifies the controller without undue delay; it does not wait for a 72-hour deadline of its own.

The legal roles and obligations are set out in Article 33 GDPR. A website audit is not a substitute for an incident investigation.

Assess possible harm to individuals, not only the reputation or turnover of your business. For each element, fill in the facts, uncertainties and supporting reasoning:

A trustworthy recipient who confirms deletion is relevant information, not an automatic exemption. Nor does an unknown number of affected individuals prove that the risk is low. Explain why the risk is or is not unlikely, and have any doubt assessed in good time. The EDPB guidelines on notifications elaborate on this assessment.

Fictitious worked example: on Friday at 10:00 a.m., a company gains sufficient certainty that an unauthorised person has viewed customer data. The 72-hour limit falls on Monday at 10:00 a.m. That is no reason to wait until Monday: the obligation is to report without undue delay and, where feasible, no later than that deadline.

If investigation results are still missing, make that visible in the initial notification. Then provide further information without further undue delay. If the notification is made later, add the reasons for the delay. Keep the timeline and proof of submission together with the supplement. An internal meeting or a missing complete report does not stop the clock.

Check the competence on the official GBA page and follow the link to the portal. The GBA states that notifications by e-mail are not processed. Also follow the instructions on account access and language.

Prepare four blocks of information: the nature of the breach with categories and estimated numbers of individuals and records; a reachable contact point; the likely consequences; and the measures taken or proposed. Where data is missing, write down what is still being investigated. Before sending, have a second person check that the contact details, times and attachments belong to the same incident.

Where a high risk is likely, the controller also informs the individuals concerned without undue delay, in clear language. Article 34 GDPR describes the content and the exceptions, such as effective protection that renders the data unintelligible to unauthorised persons or subsequent measures that eliminate the high risk. In case of disproportionate effort, an equally effective public communication may be needed; that is not a general exemption from informing.

Make the message practical: what happened, what does it mean for the recipient, which action is useful and where can they turn? Do not include unproven reassurance such as "your data has certainly not been used". Keep communication to data subjects and to the supervisory authority consistent with each other.

Document every personal data breach, even where no notification is required. For example, use this own file structure:

1. Fact log: time, observation, source and responsible investigator.
2. Decision log: risk assessment, competent authority, notification decision and reasoning.
3. Action log: measure, owner, time of execution and check of the result.
4. Communication log: submitted notification, supplements and any messages to data subjects.
5. Follow-up check: cause, structural improvements and the date on which they are checked.

Limit access to this file and do not unnecessarily include extra copies of leaked personal data. After the incident has been handled, use a check of your digital trust foundation to plan separate improvement points.