Tool 02 · Reporting duties
Who do you have to report this to?
For management and companies: the reporting duties most often overlooked when something goes wrong — with authority, deadline and channel.
A reporting duty starts the moment someone in the company learns of an incident — in IT operations, on the shop floor, in accounts. Rarely in management, almost never at the lawyer’s. Some of these deadlines run in hours, not days. So the first questions in an emergency are always the same: do we have to report? To whom? By when? You can settle them here while you are still on the phone to us.
How it is calculated. Hour deadlines run around the clock from the moment you had knowledge — night, weekend and public holiday do not stop them. Day deadlines follow §§ 187, 188 BGB. Where the law says „without undue delay", there is no date but the word: without culpable hesitation, in practice hours, not days. What counts as knowledge is contested in the individual case and often decides more than the arithmetic.
Not here: tax notification duties belong with your tax adviser. Whether your company falls under NIS2 at all is settled by the NIS2 check.
Choose the incident and enter when you learned of it. You see who reports, to whom, by when and how — and what happens if not.
The 72 hours run from knowledge, not from the end of the investigation. Notification is only unnecessary where the breach is unlikely to result in a risk to the people affected — it must always be documented (Art. 33(5)). Late notification must give reasons for the delay.
Notification to the authority — without undue delay, where feasible within 72 hours
Time missing — cannot be calculated
Informing the people affected
without undue delay, where a high risk is likely (Art. 34)
Who reports
The company that decides on the data (controller). A service provider that only processes it on the controller’s behalf reports to the controller without undue delay — not to the authority.
To whom
The data protection authority of the German state in which the company has its seat.
How
The authority’s online notification form. What is not yet known is supplied later — reporting in phases is expressly provided for (Art. 33(4) GDPR).
If not
Failing to notify, or notifying late, is a separate fineable offence, independent of the incident itself (Art. 83(4) GDPR).
Hour deadlines in real time from the time entered, in your device’s time zone; day deadlines under §§ 187, 188 BGB. Public holidays are not stored. Not legal advice.
Belongs to: Regulation & Compliance