Data Breach in Ireland: What Businesses Must Do Within 72 Hours (2026)

Last updated 9 October 2026. General information only, not legal advice.

A personal data breach can happen to any organisation — a misdirected email, a stolen laptop, a cyberattack, or an accidental disclosure. Under GDPR, when a breach occurs, the clock starts immediately. You have just 72 hours to notify the Data Protection Commission (DPC) if the breach is likely to result in a risk to individuals’ rights and freedoms. Acting quickly and correctly can make a significant difference to your legal liability and reputation. This guide explains exactly what to do.

What Is a Personal Data Breach?

Under GDPR, a personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This includes:

• Sending personal data to the wrong recipient by email or post
• A ransomware or cyberattack accessing or encrypting personal data
• Loss or theft of a device (laptop, USB drive, phone) containing personal data
• Unauthorised access to your systems by an employee or third party
• Accidental deletion of personal data without a backup
• A third-party processor suffering a breach affecting your data

Step 1: Contain the Breach (Immediately)

As soon as you become aware of a breach, act immediately to limit further damage:

• Isolate affected systems or revoke access
• Change passwords and access credentials
• Retrieve misdirected communications where possible
• Preserve all evidence — do not delete anything that could be relevant

Step 2: Assess the Risk (Within Hours)

Not every breach requires notification to the DPC. You must assess whether the breach is likely to result in a risk to individuals’ rights and freedoms. Factors to consider include:

• The type and sensitivity of data involved (health data, financial data, and special category data carry higher risk)
• The number of people affected
• The likely consequences — identity theft, fraud, discrimination, distress
• Whether the data was encrypted or otherwise protected

If in doubt, notify. The DPC takes a more sympathetic view of organisations that self-report promptly than those that fail to report at all.

Step 3: Notify the DPC Within 72 Hours (If Required)

If the breach is likely to result in a risk to individuals, you must notify the DPC within 72 hours of becoming aware of it. Late notification — or failure to notify — is itself a GDPR breach and can result in fines.

Your DPC notification must include:

• A description of the nature of the breach, including the categories and approximate number of individuals affected
• The name and contact details of your Data Protection Officer (or other contact point)
• A description of the likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

Step 4: Notify Affected Individuals (If High Risk)

If the breach is likely to result in a high risk to individuals’ rights and freedoms, you must also notify the affected individuals directly — without undue delay. This notification must be in clear, plain language and explain the nature of the breach, likely consequences, and steps they can take to protect themselves.

Step 5: Document Everything

All data breaches — whether notifiable or not — must be documented in your internal breach register. This includes the facts, effects, and remedial actions taken.

Step 6: Review and Improve

Following a breach, review what went wrong and implement measures to prevent recurrence. This demonstrates accountability to the DPC and can mitigate any potential fine.

Processors, Late Notification and Phased Reporting

If your organisation is a processor (for example a payroll or cloud provider acting on a customer’s instructions), you must tell the controller about a breach without undue delay once you become aware of it. The controller then decides whether to notify the DPC (Article 33(2) GDPR).

If a notification is made after 72 hours, it must be accompanied by reasons for the delay. Where you do not have all the information within 72 hours, Article 33(4) allows it to be provided in phases without further undue delay. The DPC asks that any update be submitted as a new version of its Breach Notification Form, marked as an update and quoting the DPC reference number.

When You Do Not Have to Tell Individuals

Even where the risk is high, Article 34(3) GDPR says you need not contact individuals if (a) the data was protected by measures such as encryption that make it unintelligible to anyone not authorised to access it, (b) you have taken steps afterwards so that the high risk is no longer likely to materialise, or (c) contacting each person would involve disproportionate effort, in which case a public communication or similar measure must be used instead. This does not remove the duty to notify the DPC where a risk exists. See also our guide to GDPR fines in Ireland and whether you need a Data Protection Officer.

Frequently asked questions

When does the 72 hours start?

The DPC states that organisations must notify within 72 hours of becoming aware of the breach. Record when and how you became aware, and who decided whether it was reportable.

How do I notify the DPC?

The DPC requires breach notifications to be made using its online Breach Notification Form on dataprotection.ie. Each notification receives a case reference beginning with “DPC”, which you should quote in any follow-up.

Do I have to record a breach I do not report?

Yes. The DPC says you must keep an internal record, including how you decided there was no risk. Article 33(5) GDPR requires every breach to be documented.

What is the maximum fine for failing to notify?

Under Article 83(4) GDPR, infringements of Articles 33 and 34 can attract fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. See our GDPR guide for employers if the breach involves staff data.

Need help strengthening your GDPR compliance? Our GDPR privacy policy document is a self-complete template. This site is not a solicitor’s practice, so for advice on a specific breach use the Law Society of Ireland’s Find a Solicitor directory. Also see our GDPR guide for small businesses.

This article is for informational purposes only and does not constitute legal advice.

Need help with this? Work of this kind is carried out by a solicitor regulated by the Law Society of Ireland. We are not a solicitor’s practice and do not provide it — to instruct a solicitor, use the Law Society of Ireland’s Find a Solicitor directory. You can also join the no-fee solicitor waiting list.