Friday, 15:40. The HR administrator writes that she sent the October payroll file to a customer instead of to the external accounting firm, because Outlook autocompleted a similar address. Someone says "call them, ask them to delete it". Nobody does anything until Monday.
This post lets you make one of three decisions within two hours of the incident: an entry in your internal breach log only, a notification to the President of UODO (Poland's data protection authority), or a notification to UODO plus informing the people whose data leaked. It does not replace a lawyer or a data protection officer (DPO), but it makes sure you don't miss the deadline and that you have the facts they will ask for.
The clock starts earlier than you think
Article 33 of the GDPR says the controller notifies the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach (source: GDPR text on EUR-Lex). 72 hours means clock hours, not working hours. An email sent on Friday at 15:40 gives you until Monday at 15:40.
"Becoming aware" is the moment the company has reliable information that the data ended up where it shouldn't. If the HR administrator knows on Friday, the company knows on Friday.
Three things people mix up most often:
- No fault does not mean no breach. UODO states plainly that an email that reached another person is a confidentiality breach, even if the address was typed correctly and the error was on the mail provider's side (source: UODO bulletin, in Polish).
- "The recipient promised to delete it" does not close the case. It lowers the risk, but the breach has already happened.
- Every breach goes into the log. Even the ones you don't report. Article 33(5) GDPR requires you to document all breaches: what happened, the effects, and what you did.
In Poland you file electronically through the form on the government portal biznes.gov.pl or to UODO's ePUAP inbox, the public administration's electronic mailbox (source: UODO, reporting breaches). If you don't have all the facts yet, you tick "preliminary notification" and complete it later. Missing information is not a reason to wait.
Three questions that settle the decision
The GDPR distinguishes three levels: a breach unlikely to result in risk (log only), a breach with risk (notify UODO) and a breach with high risk (notify UODO and inform the people affected, Article 34). To know where you are, answer three questions on paper.
1. Which data went out? A business contact's name and work email weigh differently from a PESEL number (the Polish national ID number), a bank account number, salary, sick-leave records or health data. A payroll file with PESEL numbers and amounts almost always means at least a notification to UODO.
2. Who received it, and can it be recovered? A known business partner bound by a confidentiality agreement who confirmed deletion in writing is lower risk than a private Gmail address whose owner you don't know. A USB stick lost on a train is "unknown recipient". A cloud folder shared with "anyone with the link" for three months is also "unknown recipient".
3. Was the data readable? A file encrypted with a password sent through another channel, or a laptop with BitLocker enabled, changes the assessment. Article 34(3) GDPR exempts you from informing individuals if the data was protected so that it is unintelligible to unauthorised persons. That is why laptop disk encryption is, in practice, the difference between a log entry and a letter to dozens of people.
The rule of thumb we use in projects: if you still have doubts after these three questions, you report. A preliminary notification takes about an hour. Failing to report without justification is a separate infringement, and the President of UODO can fine it independently of the leak itself.
Two cases from companies we have worked with
Done well: an accounting firm, 14 people. An employee sent a salary summary for 23 employees of one client (names, PESEL numbers, gross amounts) to another client of the firm. She noticed after 40 minutes, because the recipient replied. The owner had a one-page procedure with a template. Because the client was the controller of its employees' data and the accounting firm only a processor, the firm informed the client within an hour (Article 33(2) GDPR). Within 3 hours the client had written confirmation of deletion from the recipient, a description of the incident and a draft notification. The preliminary notification went through biznes.gov.pl the same day, and both companies logged the incident in their registers. Cost: about 6 hours of the owner's and the DPO's time, roughly 1–2 thousand PLN (about EUR 250–450). Afterwards the firm turned on a 2-minute send delay in Microsoft 365 for the payroll team and disabled autocomplete for external addresses. The lesson: the hardest part turned out to be establishing who the controller was. Had that been written into the data processing agreements, they would have saved an hour.
Done badly: a trading company, 28 people, Subiekt nexo (a popular Polish ERP for small businesses) and Microsoft 365. A salesperson shared a OneDrive folder containing an export of the customer database, about 1,900 sole traders with private phone numbers and addresses, via an "anyone with the link" link. The link circulated in emails for four months. It was found by chance during a permissions clean-up. Management spent a week debating whether it was "a leak at all". The notification went out after 9 days, with an explanation of the delay. On top of that came 2 days of an external lawyer (about 5–8 thousand PLN, EUR 1,200–1,900), a review of all sharing links in the tenant (3 days of work, about 6 thousand PLN, EUR 1,400) and three weeks of answering customer questions. The lesson: file access logs in Microsoft 365 were available from day one and would have shown who opened the link. Nobody knew they existed. Today we would check them in the first hour.
What can go wrong and what it costs
Notifying UODO is not free, even though the form is:
- UODO may ask questions. Typically you receive a letter asking for explanations and documents: the log, the risk assessment, the procedures. If you don't have them, preparing them usually takes 2–5 working days of one person.
- Informing individuals is operational work. A letter to 23 people is half a day. To 1,900 people it is a mail merge, a hotline for a few days and questions that someone has to answer consistently.
- Lawyer and DPO. If you don't have a permanent DPO, ad hoc help with one incident usually costs 2–8 thousand PLN (EUR 500–1,900), depending on scale.
- The most expensive mistake is delay. A late notification has to be justified. "We didn't know we had to" is not a justification.
When reporting does not make sense: when the data was encrypted and the key did not leak, when only business contact data (name, work email) went to a known partner who confirmed deletion, or when the data never left the company, for example a file went to the wrong employee in the same department with the same access. In those cases you make a proper log entry with the reasoning and stop there. The reasoning must be in writing.
The cheaper alternative to "always call a lawyer": a one-page procedure and a risk assessment template prepared once with a DPO or lawyer, usually for 2–4 thousand PLN (EUR 500–950) and 1–2 weeks. It is worth rehearsing it dry, as in a tabletop exercise.
What to do this week
- Check whether you have a breach log. If not, create a spreadsheet with columns: date of awareness, what happened, which data, how many people, risk assessment, decision and reasoning, actions taken.
- Write on one page: who in the company decides on notification, who has a Profil Zaufany (the Polish government e-ID) or a qualified signature to file the form on biznes.gov.pl, and the phone number of your DPO or lawyer.
- Open the external sharing report in Microsoft 365 or Google Workspace and count the "anyone with the link" links to folders with personal data.
- In two or three contracts with your accounting firm, HR provider or CRM vendor, check who is the controller and who is the processor, and how quickly they must inform you of an incident.
- Ask HR and accounting whether they sent anything to the wrong person in the last year. If they did and it is not in the log, record it now.
Every breach goes into the log, risky ones go to UODO within 72 clock hours, and for high-risk ones you inform the people affected. Three questions tell you where you are: which data, to whom, and was it readable. When in doubt, file a preliminary notification and complete it later.