Personal data breaches and proceedings before the Polish DPA (UODO)
Support in the first hours after a personal data breach and in inspections and proceedings conducted by the President of UODO.
Obligations after a breach
The controller notifies the breach to the President of UODO without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals (Article 33 GDPR).
Where the breach is likely to result in a high risk, the controller also communicates it to the data subjects (Article 34 GDPR). Every breach, including those not notified, must be documented.
Scope of assistance
- Risk assessment and decision on notification.
- Preparation of the notification to UODO and communications to individuals.
- Breach register and measures preventing further incidents.
- Preparation for UODO inspections and participation in inspection activities.
- Explanations and submissions in proceedings initiated by a complaint or ex officio.
Frequently asked questions
What if the breach is not notified within 72 hours?
A notification made after 72 hours must be accompanied by the reasons for the delay (Article 33(1) GDPR). If not all information is available, it may be provided in phases. It is better to notify on time and supplement later than to wait for full findings.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.