What to do if your data has been breached?

The short answer

In the event of a data breach, organizations must inform you within 72 hours if there is a risk to your rights and freedoms. As soon as you hear about a breach, immediately change all passwords for the accounts involved. Then check all your online accounts, bank accounts and credit card statements for suspicious activity. File a complaint with the organization that caused the breach and request measures. In case of major damage, you can also contact the Data Protection Authority.

What does the law say?

The General Data Protection Regulation (GDPR) requires organizations to report data breaches to the supervisory authority within 72 hours. If the breach is likely to pose a high risk to your rights, the organization must also inform you directly. You have the right to claim compensation if you suffer financial or immaterial damage due to the data breach. Organizations must take appropriate technical and organizational measures to prevent data breaches.

What to look out for?

Pay close attention to which specific data has been breached - this determines what steps you need to take. Passwords, credit card details and personal information each require different measures. Document all the steps you take and keep correspondence with the organization. Remain alert for identity fraud, even months after the breach.

Example from practice

Suppose an online store where you order regularly reports that their customer database has been hacked, including your name, address, email address and password. You immediately change your password for that store and all other accounts where you used the same password. You check your bank account and see suspicious transactions. You file a complaint with the store, request compensation and also report the incident to the AP because the store did not respond adequately.

What can you do?

Follow these steps systematically to optimally protect yourself after a data breach.