Data breach notification in Ireland: the 72-hour process

In Ireland, a personal data breach must be notified to the Data Protection Commission (DPC) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If the risk is high, you must also tell the people affected without undue delay, and every breach, notified or not, must be documented internally. This guide sets out the process hour by hour, with a checklist you can adopt today.

Key takeaways

• Data breach notification in Ireland follows Articles 33 and 34 GDPR: notify the DPC within 72 hours where feasible, unless the breach is unlikely to result in a risk.
• The clock starts when you have a "reasonable degree of certainty" that personal data has been compromised, according to the EDPB; a short initial investigation is allowed.
• Notify through the DPC's online breach form, give a self-declared risk rating, and send updates in phases if you do not have all the facts.
• Tell affected individuals without undue delay where the breach is likely to result in a high risk to them.
• The DPC received 6,521 breach notifications in 2025, and half arose from correspondence sent to the wrong recipient.

What counts as a personal data breach?

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That definition, in Article 4(12) of the GDPR, is much wider than hacking. A misdirected email, a lost laptop, ransomware that makes data unavailable and a staff member browsing records without reason are all breaches.

The most common Irish cause is mundane. According to the DPC's Annual Report 2025, it received 6,521 breach notifications in 2025, and half of all notifications arose from correspondence being sent to the wrong recipient.

When does the 72-hour clock start?

The clock starts when you become "aware" of the breach. The EDPB's Guidelines 9/2022 on breach notification say a controller is aware when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. After a first alert, you may carry out a short investigation to establish whether a breach has happened, and during that period you are not yet regarded as aware. The investigation should begin as soon as possible.

The 72 hours run continuously, including weekends and bank holidays. If you notify later, Article 33(1) requires you to give reasons for the delay.

What is the 72-hour process step by step?

The process has eight steps. The table shows a realistic timeline.

Time	Action
Hour 0	Incident reported internally; response lead appointed
Hours 0 to 12	Contain the incident, preserve evidence, start investigation
Hours 12 to 24	Confirm whether personal data is affected; clock starts on reasonable certainty
Hours 24 to 48	Assess risk to individuals; draft DPC notification and any message to individuals
Before hour 72	Submit DPC notification, even if incomplete
After notification	Send updates in phases; notify individuals if high risk; complete internal record

1. Report internally and appoint a lead. Everyone, including contractors, should know where to report a suspected breach. The lead coordinates IT, legal, communications and your DPO if you have one.

2. Contain and preserve evidence. Recall misdirected emails, revoke credentials, isolate affected systems and keep logs. Containment can reduce the risk rating.

3. Establish the facts. What data, how many people, which categories (for example health or financial data), who had access and whether the data was encrypted.

4. Assess the risk to individuals. Consider the type and sensitivity of the data, ease of identification, severity of consequences, number of people and whether vulnerable people such as children are involved. Decide whether the breach is unlikely to result in a risk, results in a risk, or is likely to result in a high risk.

5. Notify the DPC if there is a risk. Use the online form on the DPC's breach notification page. The DPC asks for a self-declared risk rating of low, medium, high or severe, and says you should not include personal information about affected individuals in the notification. Quote the reference number it gives you, prefixed "DPC", in all later correspondence.

6. Tell individuals if the risk is high. Article 34 requires you to communicate the breach to affected people without undue delay, in clear and plain language, where it is likely to result in a high risk.

7. Send updates. The DPC's practical guidance confirms that where you cannot provide all the information within 72 hours, you should lodge the initial notification and provide the rest in phases, without undue delay.

8. Document everything. Article 33(5) requires you to document all breaches, including those you did not notify. The DPC says your record should include the facts, the effects, the remedial action and how you decided on the level of risk, plus who made the decision.

What must the DPC notification include?

Article 33(3) GDPR sets the minimum content. The notification must:

• describe the nature of the breach, including, where possible, the categories and approximate number of people and records concerned;
• give the name and contact details of the DPO or another contact point;
• describe the likely consequences of the breach;
• describe the measures taken or proposed to address the breach and mitigate its possible adverse effects.

If a breach involves establishments or affected people in more than one Member State, the DPC asks you to mark it as cross-border on the form. Providers of publicly available electronic communications services have separate obligations under S.I. 336 of 2011 and a dedicated form.

When do you not need to tell individuals?

You do not need to tell individuals, even for a high-risk breach, if one of three conditions in Article 34(3) applies:

1. The data was protected by measures such as encryption that make it unintelligible to anyone not authorised to access it.
2. You have taken later steps that mean the high risk is no longer likely to materialise.
3. It would involve disproportionate effort, in which case you must use a public communication or similar measure instead.

The DPC can still require you to tell individuals if it disagrees with your assessment.

What if you are a processor or a SaaS provider?

Processors must notify their controller without undue delay after becoming aware of a breach, under Article 33(2). They do not notify the DPC themselves for their customers' data. The DPC's guidance says breach reporting arrangements should also be set out in the Article 28 contract, so build a customer notification timeline into your data processing agreement. Our GDPR checklist for a new SaaS product covers what that agreement needs.

Could other reporting rules apply at the same time?

Yes. A cyber incident can trigger several regimes with different clocks, such as NIS2 for essential and important entities and the Cyber Resilience Act for manufacturers of products with digital elements. See where NIS2 stands in Ireland and our explainer on Cyber Resilience Act reporting.

Changes are proposed. The Commission's November 2025 digital omnibus would create a single entry point for incident reports, and the EDPB and EDPS joint opinion of February 2026 notes that the proposal would raise the notification threshold to high-risk breaches and extend the deadline from 72 to 96 hours. These are proposals still in negotiation; the 72-hour rule applies today.

Breach notification checklist

• [ ] Internal reporting route known to all staff and contractors
• [ ] Named response lead and deputy, with out-of-hours contacts
• [ ] Containment playbooks for misdirected email, lost devices, ransomware and account compromise
• [ ] Risk assessment template using data type, volume, identifiability and severity
• [ ] DPC breach form bookmarked and draft wording prepared
• [ ] Template message for affected individuals in plain language
• [ ] Processor notification terms in every DPA
• [ ] Breach register recording every incident and decision
• [ ] Annual tabletop exercise

This is general guidance, not legal advice. For a serious breach, involve your DPO and legal advisers from the first hours.

Frequently asked questions

Do I have to report every data breach to the DPC?

No. You must notify the DPC unless the breach is unlikely to result in a risk to individuals. You must still record every breach internally, including your reasons for not notifying.

What happens if I miss the 72-hour deadline?

Submit the notification as soon as possible and explain the reasons for the delay, as Article 33(1) requires. Failing to notify, or notifying late without good reason, is itself an infringement that the DPC can take into account.

Does the 72-hour clock pause at weekends?

No. The 72 hours run continuously from the moment you become aware. That is why a pre-agreed response plan and out-of-hours contacts matter.

Is a misdirected email a reportable breach?

It is a personal data breach. Whether it must be notified depends on the risk: an email with a name sent to a colleague may be low risk, while health or financial details sent to an outsider usually require notification.

Can I report a breach before I have all the facts?

Yes. The DPC's guidance supports submitting an initial notification within 72 hours and providing further information in phases, without undue delay.

If you want help building a breach response plan into your product and processes, book a free 30-minute call.

Cover photo by RDNE Stock project on Pexels.