Customer data leaked through an AI tool: a GDPR 72-hour personal data breach sheet for small EU businesses (Articles 33 and 34)
What you get: a finished breach sheet to fill once per incident: a clock line for the 72 hours, a "is it a breach?" table with six common AI tool cases, a risk table for the notify / don't notify call, the four items the authority must be told, a note to the people affected when the risk is high, and a breach log row you keep for every case.
The short answer
If personal data in an AI tool is disclosed, accessed, changed, lost or destroyed by accident or without authorisation, that is a personal data breach (Article 4(12) GDPR). You must notify your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people (Article 33(1)). If the risk to people is high, you must also tell them without undue delay (Article 34(1)). Whatever you decide, record the breach (Article 33(5)).
Step 1: start the clock
| Line | Fill in |
|---|---|
| First sign | [date, time] [who noticed, how: customer email, supplier notice, staff report] |
| Aware at | [date, time]. You are aware when you have a reasonable degree of certainty that a security incident has led to personal data being compromised (EDPB Guidelines 9/2022). A short investigation to establish this is fine; do not wait for every detail. |
| 72 hours ends | [aware time + 72 hours]. Weekends and holidays count. If you notify later, give the reasons for the delay (Article 33(1)). |
| Supplier told you at | [date, time]. Your processor must tell you without undue delay (Article 33(2)); in principle you are aware once it has informed you. |
| Owner | [name]. If you have a DPO, involve them now. |
Step 2: is it a breach? Six AI tool cases
| What happened | Type | Contain it first | Breach? |
|---|---|---|---|
| Website chatbot shows one customer's chat to another | Confidentiality | Take the chat history feature offline; ask the supplier which sessions were affected and for how long | [yes / no / unsure] |
| Shared AI workspace or prompt library opened to people who should not see it | Confidentiality | Remove the access; export the access log; list which files and chats held personal data | [yes / no / unsure] |
| AI meeting note-taker sends a transcript to the wrong attendees | Confidentiality | Ask recipients to delete it and confirm; note who received it and when | [yes / no / unsure] |
| AI supplier reports a security incident affecting your account | Depends on the facts | Ask in writing what data, which customers, since when, and what it has done (Article 28(3)(f)) | [yes / no / unsure] |
| AI tool overwrites or corrupts customer records | Integrity | Stop the sync; restore from backup; list which records changed | [yes / no / unsure] |
| Only copy of chat or call history lost or encrypted by ransomware | Availability | Check backups; note how long the data is unavailable and who is affected | [yes / no / unsure] |
The three types come from the EDPB guidelines: confidentiality (unauthorised or accidental disclosure or access), integrity (unauthorised or accidental alteration) and availability (accidental or unauthorised loss of access or destruction). A case can be more than one type. Staff pasting customer data into an AI tool your business has not approved can also raise questions; record what was shared, with which service, and assess it the same way. If you are unsure whether it is a breach, write down why you decided either way.
Step 3: the risk call
| Question | Look at | Answer |
|---|---|---|
| What data | Contact details only, or also IDs, payment data, health data, children's data, passwords | [your answer] |
| How many people | Approximate number of people and records (Article 33(3)(a) asks for this) | [your answer] |
| Who could see it | A trusted recipient who confirmed deletion, or unknown people on the internet | [your answer] |
| Can it identify people | Names, emails, voice or face, or pseudonymised data only | [your answer] |
| Was it protected | Encrypted with the key safe, or readable | [your answer] |
| Possible harm | Fraud, identity theft, embarrassment, discrimination, loss of confidentiality | [your answer] |
Decision: [unlikely to result in a risk: log only] / [risk: notify the authority] / [high risk: notify the authority and tell the people affected]. The EDPB advises that if in doubt, the controller should err on the side of caution and notify. Its separate Guidelines 01/2021 give worked examples, including ransomware and data sent to the wrong person.
Step 4: notify the authority (Article 33(3))
| 33(3) | The authority must be told at least | Your text |
|---|---|---|
| (a) | The nature of the breach, and where possible the categories and approximate number of people and of records concerned | [..] |
| (b) | The name and contact details of your DPO or other contact point | [..] |
| (c) | The likely consequences | [..] |
| (d) | The measures taken or proposed, including steps to reduce possible harm | [..] |
If you do not have everything yet, you may give the information in phases without undue further delay (Article 33(4)). Use your authority's own breach form; most publish one online. Notify the authority competent under Article 55 (with cross-border processing, normally your lead authority under Article 56).
Step 5: tell the people affected when the risk is high (Article 34)
[Name], on [date] we found that [what happened, in plain words] in [the AI tool]. It involved your [data types]. This may mean [likely consequences]. We have [what you did] and we suggest you [for example: watch for unexpected emails, change a password]. Questions: [contact point]. [Your name, business]
The message must be in clear and plain language and give at least the contact point, likely consequences and measures (Article 34(2)). You do not need to send it if the data was protected so it is unintelligible to anyone not authorised (for example encryption), if later measures mean the high risk is no longer likely, or if it would involve disproportionate effort, in which case a public communication or similar measure is needed instead (Article 34(3)).
Step 6: the breach log row (every breach)
| Date aware | AI tool | What happened | Data and people | Effects | Action taken | Risk decision and why | Authority notified? | People told? |
|---|---|---|---|---|---|---|---|---|
| [..] | [..] | [..] | [..] | [..] | [..] | [..] | [date / no, why] | [date / no, why] |
Article 33(5) requires you to document any personal data breach, including the facts, its effects and the remedial action, so the authority can check compliance. That includes breaches you decided not to report.
Do this week
- For each AI tool, note the supplier's security contact and how it will tell you about incidents
- Check each AI supplier contract includes the processor's duty to help you with breaches (Article 28(3)(f))
- Find your data protection authority's breach form and save the link with this sheet
- Agree who in the business can make the risk call at a weekend
Law changes under discussion: the European Commission's Digital Omnibus proposal (COM(2025) 837) would change Article 33 so that only breaches likely to result in a high risk are notified, within 96 hours. As of 21 October 2026 it has not been adopted; the 72-hour rule above is the law in force. Check the current text before relying on any change.
This sheet is a working aid, not a legal opinion or proof of compliance. GDPR references are to Regulation (EU) 2016/679 (Articles 4(12), 28, 33 and 34). For detail, see EDPB Guidelines 9/2022 on personal data breach notification (version 2.0, adopted 28 March 2023) and Guidelines 01/2021 on examples. Checked on 21 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often learn about a breach from an AI supplier email on a Friday evening. At the next review, fill Step 1 and the "Do this week" list with them for each AI tool, and keep the result with their client AI inventory. Stay inside your professional rules and pass real incidents to a privacy professional or lawyer.
Keep the sheet next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with its supplier contact, so Step 1 takes minutes.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then keep this sheet ready. Related: Article 15 access-request sheet · DPIA screening sheet · AI incident and complaint log · AI supplier contract clauses.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 4(12), 28, 33, 34, 55, 56
- EDPB Guidelines 9/2022 on personal data breach notification under GDPR
- EDPB Guidelines 01/2021 on examples regarding personal data breach notification
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.