One article, with its sources
Reporting a data breach
Report a suspected breach to the security team at once, using the incident form, and do not investigate it yourself 1. The Data Protection Officer decides within 72 hours whether the authorities must be told 2. This replaces the 2022 rule, which allowed 5 days.
- 1Incident Response Procedure, step 1
- 2Data Protection Policy 2025, section 8