Website Hacked? When to Report a Data Breach in 72 Hours

If your website was hacked and it stores personal data (orders, customer accounts, contact form entries, newsletter lists), you may have to report a personal data breach to your data protection authority within 72 hours of becoming aware of it. You don't have to report when the breach is unlikely to create a risk for the people whose data it is, but you must document every breach, reported or not. When the risk is high, you also have to tell those people. The clock starts when you are reasonably sure personal data was affected, not when the attack happened, so the first job is to find out quickly what the attacker could reach. This guide explains how to decide, which facts to collect in the first hours, and where to report in the EU, the UK and Thailand. It is written by developers who clean up hacked sites, not by lawyers: when in doubt, ask your data protection officer or lawyer the same day.

Is a hacked website a data breach?

Not always. Under the GDPR a personal data breach is a security incident that leads to personal data being destroyed, lost, changed, disclosed or accessed without permission. A hack on a site that holds no personal data, such as a brochure site without forms or accounts, is a security incident but not a personal data breach. A hack on a webshop, a booking site or a member portal usually is, because the attacker could reach customer data even if you can't prove they took it.

The European Data Protection Board (EDPB) groups breaches into three types, and a hack can be all three at once:

• Confidentiality: someone saw or copied data they shouldn't have, for example a downloaded customer table or a database backup left in a public folder.
• Integrity: data was changed, for example injected scripts in order pages or altered bank details on invoices.
• Availability: data was lost or locked, for example by ransomware or a wiped database without a working backup.

When does the 72-hour clock start?

Article 33 of the GDPR says you notify "without undue delay and, where feasible, not later than 72 hours after having become aware" of the breach. The EDPB's guidelines on breach notification explain that you are aware once you have a reasonable degree of certainty that a security incident has led to personal data being compromised. You may take a short time to investigate whether that is the case, but that investigation must start immediately.

In practice: the hours you spend wondering whether a strange redirect is serious are not free. As soon as you see signs of a hack on a site with customer data, start collecting facts. If you can't finish in 72 hours, the regulators in Belgium, the Netherlands, France, Germany and the UK all accept a first report within the deadline that you complete later. A late report has to explain the delay.

If a developer or hosting company runs the site for you, they are your processor. They must tell you without undue delay when they discover a breach. The duty to notify the authority stays with you, the business that decides what the data is for.

Report or not: how to decide

Situation	Report to the authority?	Tell the people affected?
Hack on a site without personal data (no forms, accounts or orders)	No, it isn't a personal data breach	No
Spam pages or a redirect injected, no access to the database or form entries	Usually not, if you can show the data wasn't reachable; document why	No
Attacker had admin or database access to customer names and email addresses	Usually yes: you can't rule out a risk	Depends on the risk; often yes if phishing is likely
Passwords, ID documents, payment details or health data exposed	Yes	Usually yes: high risk
Ransomware or a wiped database, with a recent clean backup restored	Depends on whether data was also copied and how long it was unavailable	Only if the risk is high
Data was encrypted with a key the attacker didn't get	Often still yes, but the risk is lower	Usually no: the GDPR exempts data that is unintelligible to the attacker

The question is always the risk for the people in the data, not the damage to your business. Weigh what kind of data it is, how many people, whether they can be identified, and what someone could do with it: phishing, identity fraud, embarrassment, financial loss. If you hesitate, the French regulator CNIL's advice is to notify; the authority can then tell you whether you must also inform the people affected.

What to collect in the first hours

A notification asks for facts. These are the ones a developer can help you find, and they also guide the cleanup:

1. What happened and when: the first sign you saw, when you saw it, and when the attack probably started. Server logs, file change dates and new admin accounts usually show the start.
2. Which systems were reached: only the website files, or also the database, the admin area, email accounts or a connected system such as your shop's back office.
3. Which personal data was there: customers, orders, form entries, newsletter subscribers, employees, sellers or members. List the tables or exports and the fields in them.
4. How many people: an estimate is fine for a first report. A database count gives you a number in minutes.
5. Whether data left the server: look for unusual downloads, large responses in the access logs, database dumps or exports in public folders. Clean logs are not proof that nothing was taken.
6. What you have done: passwords reset, hole closed, site restored, backups checked, customers warned.
7. Who your contact person is: the regulator will want someone who can answer follow-up questions.

Keep these notes even if you decide not to report. Article 33(5) of the GDPR requires a record of every breach: the facts, the effects and what you did about it. The Dutch and French regulators both ask for this internal breach register.

Where to report

Country	Authority	How
Belgium	Data Protection Authority (GBA/APD)	Online portal with a company account; in Dutch, French or German. Email reports are not processed.
Netherlands	Autoriteit Persoonsgegevens	The online meldloket datalekken; not by phone, post or email.
France	CNIL	Online notification service; a first notification can be completed later.
Germany	The data protection authority of your federal state (Land); telecom providers report to the BfDI	Each state runs its own online form, for example Berlin and Baden-Württemberg.
United Kingdom	Information Commissioner's Office (ICO)	Online breach report within 72 hours; you can report in phases.
Thailand	PDPC Office	Data breach report e-service on the PDPC website, within 72 hours of becoming aware where feasible (PDPA section 37(4)).

If your business is in one EU country and your customers in several, you usually report to the authority where your main establishment is. Some sectors, such as telecom, have their own extra rules.

A real case: a seller portal on an unmaintained site

In September 2026 a Belgian second-hand shop chain came back to us after four years without contact. A major cyber attack had broken nearly everything on their WordPress sites, including the portal where their sellers log in to follow their items and payouts. Repairing the sites and closing the holes the attackers had used took 2 days of work.

A portal like that holds exactly the kind of data this article is about: names, contact details and payout information of its sellers. That is why the technical questions above (what was reachable, since when, and whether anything left the server) matter as much as getting the site back online. The decision to report stays with the business; our job is to give it the facts quickly enough to decide within the deadline.

After the report: close the hole

Reporting doesn't fix anything. The same steps as for any hacked site still apply: reset every password, find and close the way in, replace infected files, update everything and check that backups are clean. Our step-by-step guide WordPress site hacked? What to do in the first hour covers that part. Regulators also look at what you did to prevent it happening again, so write down the measures you take: two-factor login, removing unused plugins, monitoring, and someone responsible for updates. If the site has gone unmaintained for a while, what website maintenance really costs helps you decide how to keep it safe from now on.

What it costs to get the facts

Option	Price excl. VAT	Good to know
Your own team or hosting company	Your time, or the host's plan	Fine if they can read server logs and the database. Many hosts only restore a backup.
WDDW emergency help	$85/hour, no minimum	A senior developer starts the same day: finds what was reachable, collects the facts for your report and closes the hole.
WDDW emergency help at the weekend	$127.50/hour	Attacks don't wait for Monday, and neither does the 72-hour clock.
WDDW strip card	$1,050 for 14 hours	Prepaid hours for the follow-up work: updates, two-factor login, monitoring.

For a typical small business site, establishing what was reachable takes a few hours, not days. A full recovery takes longer when the site has been unmaintained for years, as in the case above. Our pricing page lists all options.

Hacked and the clock is running? We start today

Book emergency help and a senior developer starts on your site the same day, at $85/hour excl. VAT with no minimum and no intake call. We sign an NDA if you need one, find out what the attacker could reach, write down the facts for your report and close the hole. We don't give legal advice and can't decide for you whether to report, but we make sure you have the facts in time. Prefer to talk first? Contact us in English, Dutch, French, German or Thai.