Data breach plan for a therapy practice in Ireland: the 72-hour rule
A session note sent to the wrong person, a stolen laptop or a hijacked email account can all be a personal data breach. The GDPR sets a clock that starts when you become aware of it. Here is how that clock works for a private practice in Ireland, and a one-page plan you can write today.
A note on this guide: it is general information for practitioners, not legal advice. Where a point depends on your professional body or your own circumstances, we say so rather than guess.
What counts as a breach in a therapy practice
A personal data breach is not only hacking. Everyday examples in a practice include an email with a report sent to the wrong address, a phone or laptop with unencrypted client files that is lost or stolen, a shared mailbox that the wrong person can read, paper files left somewhere they should not be, or a software vendor telling you that client data was exposed. All of these can affect confidentiality, integrity or availability of the data you hold.
The rules, as published
Article 33 of the GDPR and the Data Protection Commission's guidance say the following:
- Notify the DPC without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If you notify later, you must explain the delay.
- No notification is needed if the breach is unlikely to result in a risk to the rights and freedoms of individuals.
- Use the DPC's Breach Notification Form. The DPC states that all breach notifications must be made using it. The DPC also asks you not to include the personal information of affected individuals in your notification.
- The notification must describe the nature of the breach, give a contact point, explain the likely consequences, and set out the measures taken or proposed.
- Record every breach, including the ones you do not report. Article 33(5) requires you to document the facts, effects and remedial action. The DPC adds that where you decide there was no risk, you need to keep a record of the details, how you decided there was no risk, who decided, and the risk rating recorded.
- Tell the individuals without undue delay where the breach is likely to result in a high risk to them.
- Processors must tell you. A processor must alert the controller without undue delay after becoming aware of a breach.
A one-page plan
Write this on a single page and keep a copy that does not depend on the systems that might fail.
- Who decides. Name the person who assesses incidents. In a solo practice, that is you; in a group, one named lead and one deputy.
- Write down the moment you found out. The 72 hours run from awareness. Note the date, time and how you learned of it.
- Contain. Change passwords, revoke device access, recall or request deletion of a misdirected email, report a lost device to the relevant parties.
- Assess the risk. What data, how many clients, how sensitive (session notes are far more sensitive than appointment times), could it be read by others, was it encrypted?
- Decide and document. Notify the DPC or not, inform clients or not, and write down why.
- Notify. If required, use the DPC's form within the deadline. Contact affected clients personally and in plain language, say what happened and what you are doing.
- Review. What would have prevented it? Change the process, not just the password.
Related guide
Read this next: GDPR checklist for psychologists in Ireland
Prevention that makes most incidents low-risk
Article 32 names encryption and the ability to restore access to data after an incident among the measures to consider. In practice that means:
- Device encryption and a screen lock on every phone and laptop you use for work.
- Records in a system with access control and an activity log, not in email attachments.
- Two-step verification on your email and practice software.
- Checking the recipient before sending anything about a client, and avoiding client names in subject lines.
- A vendor that commits in its processor terms to tell you promptly of any breach on its side.
A note on what we cannot tell you
Whether a particular incident is "likely to result in a risk" is a judgement. For a sole practitioner, a mis-sent appointment reminder and a mis-sent assessment report are in different categories. If you are unsure, ask your data protection adviser or professional body, and record how you decided. Also, check whether your professional indemnity or cyber insurance has its own notification deadlines, which may differ from the DPC's.
Sources
All pages below were consulted on 7 November 2026.
- GDPR Article 33: notification of a personal data breach to the supervisory authority
- Data Protection Commission: breach notification
- GDPR Article 32: security of processing
- GDPR Article 28: processor
Frequently asked questions
Do I have to report every breach to the DPC?+
No. Notification is not required if the breach is unlikely to result in a risk to people's rights and freedoms. But you must still record every breach, including the facts, effects and your reasoning, as Article 33(5) requires and the DPC reiterates.
When does the 72 hours start?+
From when you become aware of the breach. Article 33 says without undue delay and, where feasible, not later than 72 hours after becoming aware. If you notify after 72 hours, you must give reasons for the delay.
What if my software vendor has the breach, not me?+
A processor must notify the controller without undue delay after becoming aware. You, as controller, then assess whether you must notify the DPC and your clients. Check that your vendor's terms commit to prompt notice.
Do I need to tell my clients?+
Where a breach is likely to result in a high risk to them, the DPC says organisations must inform those individuals without undue delay. If the risk is lower, the duty to notify them does not apply in the same way, but you still document your decision.
Keep your practice records in one secure place
Scheduling, client records and session notes in one place, hosted in the EU. Free for 14 days, no card.
14 days free, no card · No lock-in · We answer directly
Nerela is practice management software built for psychologists and clinics: scheduling and online booking, patient records and session notes, payment receipts and reports — in one place, with data hosted in the European Union. You start with 14 days free, no card, and you talk directly to the people building the product.
Start on Nerela — 14 days free →