Datenpanne

A notebook disappears during a move, a box of old devices stands open in the hallway, a hard drive is resold without being erased: the question quickly arises whether this is a data breach and whether you have to report it. This glossary entry explains what the GDPR understands by a data breach, which deadlines apply and why decommissioned IT in particular is a typical trigger.

What is a data breach under Art. 33 GDPR?

The GDPR does not speak of a "data breach" but of a "personal data breach". Art. 4 No. 12 GDPR defines it as a breach of security that leads to the destruction, loss or alteration of, or to the unauthorized disclosure of or unauthorized access to personal data . It does not matter whether the cause was an attack, an oversight or a technical defect.

Experts distinguish three types:

• Breach of confidentiality: Unauthorized persons can view data, for example because a hard drive that has not been erased falls into the wrong hands.
• Breach of integrity: Data is altered without authorization.
• Breach of availability: Data is lost or permanently no longer accessible, for example because the only storage medium is missing.

Art. 33 GDPR regulates the notification to the supervisory authority, Art. 34 GDPR the notification of the persons concerned.

What does this mean for retired IT?

As long as data has not been verifiably erased, every old device is a data carrier in need of protection. Typical data breaches around decommissioning are:

• A device is lost between the workstation, storage and service provider.
• Hard drives, SSDs or smartphones are sold, given away or disposed of without certified erasure.
• Copiers, servers or network storage are forgotten although they contain internal data carriers.
• Old devices are stored openly accessible for weeks before they are collected.

Whether a notification is necessary depends on the risk. If a lost notebook was encrypted in line with the state of the art, for example with BitLockerand the key has not been compromised, the risk can be low. Notification of the data subjects can then be omitted under Art. 34(3) GDPR. However, you must make and document this assessment in each individual case.

Obligations and deadlines at a glance

Who?	What?	Deadline / basis
Controller	Notification to the competent supervisory authority, unless the breach is not likely to result in a risk	Without undue delay, where possible within 72 hours after becoming aware (Art. 33(1))
processor	Notification to the controller, for example a logistics or erasure service provider	Without undue delay (Art. 33(2))
Controller	Notification of the persons concerned where a high risk is likely	Without undue delay (Art. 34)
Controller	Internal documentation of every breach with facts, effects and remedial measures, even if no notification was necessary	Ongoing (Art. 33(5))

The notification must describe at least the nature of the breach, the approximate number of data subjects and data records, a contact person, the likely consequences and the measures taken (Art. 33(3)). If information is missing, you may provide it in stages. If the 72-hour deadline is exceeded, the delay must be justified.

Typical mistakes in handling data breaches

• No device list: without Inventory list with serial numbers, it is impossible to say which device is missing and what data was on it.
• Gaps in the handover: without Chain of custody it remains unclear where a device was lost.
• Late assessment: The question "report or not?" is asked only after days because nobody is responsible.
• Missing documentation: Breaches without a reporting obligation also belong in the internal register. That is part of the Accountability.
• Relying on the reset: A factory reset without proof does not count as documented erasure.

Practical example: a box is missing

A simplified example shows how a breach arises and how you react.

1. A company collects 40 old notebooks in the basement. Some of the devices are encrypted, some are not.
2. At collection, the driver counts only boxes, not devices. Later, five notebooks are missing.
3. IT compares the serial numbers with the device list: two of the missing devices were unencrypted and contained personnel data.
4. The data protection officer assesses the risk, the company reports the breach within 72 hours and documents the measures.
5. In future, devices are sealed before collection and handed over by serial number.

With a handover by exact serial number, the loss would have been noticed immediately, and with consistent encryption the risk would have been considerably smaller.

Avoiding data breaches: decommissioning with Second IT

Second IT collects decommissioned hardware with its own secure logistics: direct trips without intermediate storage, GPS monitoring, tamper-proof sealing and insured transport. At goods receipt, every device is checked for all storage media and registered by serial number, including forgotten USB sticks or hidden hard drives. Processing takes place in areas with access control and video surveillance. Erasure is carried out with Blancco, with a digitally signed erasure certificate for each device. More on Data security at Second IT.

Distinction from related terms

Not every IT security incident is a data breach within the meaning of the GDPR. What matters is whether personal data is affected. Conversely, Art. 32 GDPR requires such breaches to be prevented through technical and organizational measures from the outset. For entities covered by NIS2 , additional reporting obligations for significant security incidents toward the BSI may apply (as of 10/2026). Anyone who violates reporting obligations risks a GDPR fine. How to dispose of data carriers with clean documentation from the start is explained in our guide Disposing of data carriers under the GDPR. Which data lies dormant on old hard drives is shown in the article Corporate DNA on hard drives.

This entry gives a general overview and does not replace legal advice in an individual case.

Frequently asked questions about data breaches

Is a lost company notebook always a reportable data breach?

Not always. A breach is reportable if it is likely to result in a risk to the data subjects. If the device was encrypted in line with the state of the art and the key is secure, the risk can be low. However, you must document the assessment and its result in every case.

When do the 72 hours start running?

The deadline begins as soon as the controller knows with reasonable certainty that a breach has occurred. An initial check as to whether a breach exists at all is permissible but must not be dragged out. You can supply missing details later.

Who reports if the breach occurs at the service provider?

As a processor, the service provider is obliged to inform you without undue delay. However, the notification to the supervisory authority remains your task as controller. Therefore regulate reporting channels and deadlines in the data processing agreement.

Is selling an unerased old device a data breach?

Yes, if it contains personal data and unauthorized persons can access it. This also applies if the data was "only" formatted or moved to the recycle bin, because such data can often be recovered.

Do I also have to record breaches without a reporting obligation?

Yes. Under Art. 33(5) GDPR, you document every breach with facts, effects and remedial measures. The supervisory authority can inspect this documentation.