GDPR is often treated as a legal problem, something for lawyers and compliance officers. But the vast majority of GDPR breaches have a technical cause. An unencrypted server, an employee who clicks a phishing link, a system that hasn't been updated. GDPR and IT security are two sides of the same coin.

This article explains the connection in concrete and understandable terms, without legal jargon.

What exactly is a 'personal data breach' from a technical standpoint?

GDPR uses the concept of breach of personal data security. It sounds abstract, but technically it covers three scenarios:

  • Confidentiality breach: unauthorized parties gain access to personal data. Example: a hacker breaks into your customer system, or an employee sends an email with CPR numbers to the wrong recipient.
  • Integrity breach: data is altered unintentionally or without authorization. Example: ransomware encrypts or manipulates your data.
  • Availability breach: data is not available as it should be. Example: downtime in your system that means you cannot deliver a service which processes personal data.

Note: the third point surprises many. Losing access to your own data, because a system crashes or because you lack backup, is technically a GDPR breach if it affects individuals' rights.

The 72-hour rule: what it actually requires of you

If a breach occurs, you generally have 72 hours to report it to the Danish Data Protection Agency (Datatilsynet), from the moment you "become aware" of the incident. Failure to report is in itself a violation that can trigger a fine.

72 hours sounds like a lot, but in practice it's tight. Especially if you don't have an incident plan ready. Who in the company discovers a breach? Who decides whether to report it? Who contacts the Danish Data Protection Agency? Who writes the notification?

A report to the Danish Data Protection Agency must include:

  • A description of the nature of the incident: what happened and how
  • Which categories of personal information are affected
  • Approximate number of affected individuals
  • Likely consequences for the individuals
  • What measures you have taken or plan to take

This requires you to actually know what personal information you have, where it's stored, and what has happened. That knowledge presupposes good IT hygiene in daily operations.

Practical tip: Create a simple document with a contact person, a procedure and a link to Datatilsynet's reporting portal. Share it with management. It can save you from chaos if something happens at 10 p.m. on a Friday.

What is meant by 'appropriate technical measures'?

GDPR requires you to implement appropriate technical and organizational security measures. This is deliberately vague. The law does not define precisely what it requires. But guidance from Datatilsynet and ENISA (the EU's cybersecurity agency) points to a core of expected measures:

  • Encryption , particularly of portable devices and during data transfer
  • Access control: employees should only have access to the data they need for their work
  • Logging and monitoring: you must be able to document who accessed what
  • Regular updates: known vulnerabilities must be closed in a timely manner
  • Backup and recovery: you must be able to restore data after a loss
  • Password policy and MFA: strong passwords and two-factor authentication

What is 'appropriate' is assessed based on your company's size, the data you process, and the risk to individuals. If you handle sensitive information like health data, requirements are higher than if you only have a customer database with names and email addresses.

The most common GDPR breaches resulting from poor IT security

The Danish Data Protection Agency receives thousands of reports from Danish companies every year. The most recurring technical causes are:

  1. Phishing attacks: an employee clicks a link and hands over their login credentials. The result is typically access to email or systems containing personal data. MFA would in most cases have stopped this.
  2. Wrong recipient: an email with personal data is sent to the wrong person. Technically simple, but system errors and time pressure make it one of the most common causes.
  3. Ransomware: data is encrypted and inaccessible. Even if the ransom is not paid, a breach has occurred.
  4. Lack of access control: a former employee still has active access to systems. This happens frequently when the offboarding process does not include IT.
  5. Loss of unprotected device: a laptop or USB stick without encryption is lost or stolen.

What can you do now?

Improving the situation doesn't require a major project. Start with these three steps:

  1. Enable MFA on all work accounts , particularly email and cloud services. It is the single measure that prevents the most breaches.
  2. Encrypt portable devices. Windows BitLocker and Apple FileVault are free and built-in. It takes less than an hour to enable.
  3. Create a simple offboarding checklist , one that includes deactivating all IT accounts, not just removing the badge and key.

GDPR is not something you handle once and forget. It's an ongoing practice. But the most important foundation is basic IT hygiene. It protects you on both fronts.