Personal data breach at the firm: the 72 hours and the notification
The moment the firm became aware gives the end of the 72 hours, Belgian time, then what follows: notifying the DPA or not, informing the persons or not, and the documents to prepare.
What the rule says
Rules verified on 07/10/2026
Notify the Belgian Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people (GDPR art. 33(1)). The 72 hours run continuously, weekends and public holidays included. Where the risk is high, inform the persons concerned without undue delay (art. 34).
Every breach goes in the firm's own breach register, notified or not, with its facts, effects and remedial action (art. 33(5)).
Your result appears here
The result appears as soon as the required fields are filled in.
A laptop with client files, not encrypted, lost on Friday 9 October 2026 at 18:30.
Sources
Rules verified on 07/10/2026
- Regulation (EU) 2016/679 (GDPR)
- Regulation (EEC, Euratom) No 1182/71 (periods, dates and time limits)
- EDPB Guidelines 9/2022 on personal data breach notification, v2.0
- Belgian DPA: breach notification user manual, v2.0 (02/02/2026)
- OVB, GDPR-wijzer: data breaches
A drafting aid based on the sources cited. To be reviewed and adapted by the lawyer; it is neither advice nor a guarantee of compliance.
How it works
How the calculation works
- Starting point. The moment the firm is reasonably certain that personal data were affected. A short investigation may come first, but it starts at once (EDPB Guidelines 9/2022). Informed by a processor, the firm becomes aware at that moment.
- 72 continuous hours. An hour-based period includes weekends and public holidays and never moves to the next working day (Regulation 1182/71, art. 3(3) and 3(4)). The tool shows awareness plus 72 hours.
- Strict reading. Under art. 3(1) of the Regulation, the hour in which the firm became aware is not counted: the period would end at the next full hour. The tool says so but keeps the earlier time.
- Clock changes. The period counts real hours: if summer time starts or ends during the 72 hours, the end falls one hour earlier or later on the clock. Example: aware on Friday 23 October 2026 at 14:20, end on Monday 26 October at 13:20.
- The APD form. Part 1 within 72 hours, even without an enterprise account; part 2 within 21 calendar days, with reminders on days 7 and 14 (APD manual, v2.0).
The risk and what follows
The tool suggests a level from the answers (what was affected, which data, vulnerable people, what reduces the risk), says why, and leaves the decision to you:
- risk unlikely: no notification to the Belgian DPA, but a register entry with the reasons (art. 33(5));
- risk: notification to the Belgian DPA (art. 33(1));
- high risk: notification and information to the persons without undue delay (art. 34), unless the data were unintelligible, the risk was removed, or a public communication replaces disproportionate individual notices (art. 34(3)).
The loss of confidentiality of data covered by professional secrecy is a damage the GDPR names expressly (recitals 75 and 85): losing an unencrypted client file in principle leads to a high risk.
The documents
The breach register entry, the draft notification to the Belgian DPA (the four items of art. 33(3)) and the draft message to the persons, in plain language, with advice depending on the data affected. PDF and Word exports in the language you choose, and a calendar file with the end of the 72 hours and the last day for part 2.
What the tool does not do
- It does not notify the Belgian DPA: notification is made on the APD's portal.
- It does not check duties towards the professional liability insurer or the bâtonnier, nor the NIS2 law.
- It sends nothing: facts, consequences and contacts stay in this tab; only dates, time and options appear in the page address.
Verification
The rules were checked on 7 October 2026. The tool assists the lawyer, who remains responsible for the assessment and the notification.
Updated on 7 October 2026
Frequently asked questions
Do the 72 hours include the weekend?
Yes. A period expressed in hours includes Saturdays, Sundays and public holidays and does not move to the next working day (Regulation 1182/71, art. 3(3) and 3(4), to which the EDPB Guidelines 9/2022 refer). Becoming aware on Friday at 18:30 gives an end on Monday at 18:30.
When do the 72 hours start?
When the firm is reasonably certain that an incident has compromised personal data. A short investigation to establish this is allowed, but it starts at once. If a processor (IT provider, cloud) discovers the incident, it tells the firm without undue delay, and the 72 hours run from that notice.
Must the firm notify if the lost laptop was encrypted?
If the encryption was strong, the key stayed safe and the data are available elsewhere (backup), the breach is in principle unlikely to result in a risk: no notification, but a register entry with the reasons (EDPB examples in Guidelines 9/2022). An unencrypted laptop holding client files, by contrast, calls for a notification and, in principle, informing the clients.
What if the 72 hours have passed?
Notify anyway, giving the reasons for the delay (art. 33(1) GDPR). Information may be provided in phases (art. 33(4)): part 1 of the APD form first, part 2 within 21 days.
What goes in the breach register?
The facts, their effects and the remedial action, for every breach, notified or not (art. 33(5)). The OVB recommends also noting why a breach was not notified. The entry the tool produces includes these items, the dates and times, the risk level retained and the decision.
When should the clients concerned be informed?
When the breach is likely to result in a high risk to them, without undue delay and in plain language: the nature of the breach, the contact point, the likely consequences and the measures taken (art. 34). It is not needed if the data were unintelligible, if the risk was later removed, or if the effort would be disproportionate; a public communication then replaces it.