Data breach notices: what a company must tell you

Key rules

• Report to the agency: A company must report a breach that risks people to the data-protection agency within 72 hours, and tell affected people without undue delay when the risk is high.
• Notice content: The notice must be in plain language and say what happened, who to contact, the likely consequences and what the company is doing.
• Compensation: The AEPD does not award compensation, so you claim through the courts, generally within one year.
• Act quickly: Change reused passwords, turn on two-factor authentication and ask your bank to block cards if financial data leaked.

When a company must tell you

A company must tell you without undue delay when a breach is likely to put your rights and freedoms at high risk. Leaked passwords with bank details, or copies of your ID, are typical examples.

The company must also report a breach that risks people to the data-protection agency (the AEPD) within 72 hours. That report is separate from the notice to you. If the agency thinks the risk to you is high, it can require the company to tell you.

A company does not have to send you a notice in three cases:

• The data was protected, for example by strong encryption, so nobody can read it.
• Later measures mean the high risk is no longer likely.
• Telling everyone individually would take disproportionate effort. The company must then make a public announcement or use something equally effective.

What the notice must contain

The notice must be in clear, plain language. It must:

• describe what happened;
• give the name and contact details of the data protection officer, or another contact point;
• describe the likely consequences for you;
• describe what the company has done or plans to do to fix the problem and limit the harm.

If a notice leaves one of these out, ask the company for it in writing. The documents list below shows what to keep.

What to do to protect yourself

Act on the same day if you can.

1. Change the password on the affected service. Change it anywhere else you reused it, using unique strong passwords or a password manager.
2. Turn on two-factor authentication on important accounts.
3. Watch your bank and account activity. Report suspicious charges to your bank.
4. Be wary of emails, texts and calls that use the leaked data. Do not click links or give out codes.
5. If card or bank details were exposed, ask your bank to block your cards.
6. If identity documents were exposed, watch for identity theft and consider reporting it to the police.
7. Keep your devices updated, and check whether your data appears in known leaks.

Keep screenshots and statements as evidence. The checklist below covers these steps in order.

Your rights and remedies

You can use your data rights with the company, for example to ask what data it holds about you. If it does not answer properly, you can complain to the AEPD. You can also call the 017 helpline run by INCIBE, Spain's cybersecurity institute, for free advice.

Compensation is a separate route. Anyone who suffers material or non-material damage from a data-protection breach has the right to compensation from the company. The AEPD does not award compensation. You claim in the ordinary civil courts, or in the administrative courts if the company is a public body.

To win, you must show a breach, real damage and a link between them. A breach alone is not enough. Non-material damage, such as distress, has no minimum seriousness. Fear that your data will be misused can count if it is well founded. The company escapes liability only by proving it is in no way responsible.

The time limit is generally one year, so get legal advice early. The FAQ below answers common compensation questions.

Documents you need

• The breach notice from the company, in clear and plain language. It must describe what happened, give the name and contact details of the data protection officer or another contact point, explain the likely consequences, and list the measures the company has taken or proposes to limit the harm.

• Records of suspicious charges or messages, such as bank statements or screenshots of phishing texts, to support a report to your bank, the data agency or the police, or a later claim.

Checklist

• Check that the notice you received describes the breach, names a contact point, explains the likely consequences and lists the measures taken.

• Watch your bank and account activity and report suspicious charges to your bank.

• Ignore links and codes in unexpected emails, texts or calls that use the leaked data.

• Ask your bank to block your cards if financial data was exposed.

• Contact the company to use your data rights, and report to the data agency or call INCIBE's 017 helpline if you need help.

Frequently asked questions

Can I claim compensation if my data was leaked?

Yes, you can claim compensation if the leak caused you real damage, either financial or non-financial. You must show that the company broke the data rules, that you suffered damage, and that one caused the other. The data agency does not award compensation, so the claim goes to the ordinary courts.

Is fear that my data will be misused enough to claim?

Yes, fear of misuse can count as damage, but only if the fear is well founded. A breach alone is not enough, and there is no minimum seriousness for non-financial damage.

How long do I have to claim compensation for a breach?

The usual time limit is one year for claims outside a contract under Spanish civil law. Do not wait: get legal advice early, because the exact period can depend on who is responsible and the facts.

Can I ask the data agency to make a company tell people about a breach?

Yes, the data agency can require a company to notify affected people if it judges the risk to them is high. A company may skip notifying you if the data was strongly encrypted or the high risk is no longer likely. If telling everyone would take disproportionate effort, it must use a public announcement instead.