Z. Ochońska-Borowska: The President of the Personal Data Protection Office reminds us when to report a data breach

The President of the Personal Data Protection Office (UODO) reminds organisations when to report a data breach
In light of recent incidents affecting thousands of organisations, the President of the Personal Data Protection Office has reminded organisations when it is necessary to report a data breach.

Under the GDPR, a data controller must report a breach without undue delay, unless it is unlikely to result in a risk to the rights or freedoms of natural persons. The obligation therefore depends on a thorough risk assessment, carried out on a case-by-case basis.

A notification will not usually be necessary where only business data publicly available in the CEIDG has been leaked – such as a full name, company name, tax identification number (NIP) or business address – and this was the case in recent reports, as these mainly concerned unauthorised access to contractor databases and invoicing systems. The situation is different if, in addition to these, other non-public data have been disclosed, such as a PESEL number.

It should be borne in mind that deciding not to make a notification does not exempt a company from the obligation to document the risk assessment and record the breach in its internal register. It is also important to remember that the notification should, where possible, be made within 72 hours of the breach being detected. A late notification requires an explanation of the reasons for the delay.

Importantly, the above rules may change in the near future – in November 2025, the European Commission presented the ‘Digital Omnibus’ proposal, which provides, amongst other things, for amendments to Article 33 of the GDPR.

The draft proposes extending the notification deadline from 72 to 96 hours, introducing a standard notification form, and limiting notifications to breaches likely to result in a high risk to the rights or freedoms of natural persons. Furthermore, there are plans to establish a single EU contact point for notifications.

Legislative work is still ongoing, and we are keeping a close eye on this draft!