The 72-Hour Rule: What Actually Has to Happen
25 February 2026 · Mary Molloy Solicitors
Seventy-two hours is the number everyone remembers and half remember wrongly. It is not a deadline to fix the breach, complete forensics or draft the perfect account — it is the outer limit for telling the Data Protection Commission, where telling is required at all, and the rule is built with more flexibility than its reputation suggests.
When the clock starts and when notification is required
The clock runs from awareness — a reasonable degree of certainty that a personal data breach occurred, not the completion of an investigation. Notification to the DPC is required unless the breach is unlikely to result in a risk to individuals: the misdirected email to one trusted recipient who confirms deletion may genuinely sit below the line; the lost unencrypted laptop and the systems intrusion sit above it. Whichever side you land, the assessment itself must be documented.
What the notification contains
Nature of the breach; categories and approximate numbers of individuals and records; likely consequences; measures taken and proposed; a contact point. Where the picture is incomplete — it usually is — notify in phases: an initial report within the window, supplemented as facts emerge. Late notification is made with reasons. The regulator's consistent preference is candid and prompt over polished and late.
The other duties in the same window
Where the breach is likely to result in high risk to individuals, they must be told without undue delay in plain, useful language — the duty most visible to the outside world and most litigated after the fact. And every breach, notified or not, goes in the internal register: facts, effects, remedial action. The register is the accountability document inspections start with, and the quiet proof the organisation runs its obligations rather than discovering them per incident. Our interactive checklist walks the full sequence.
Read more in our main guide: Data Breach Response: The First 72 Hours · or back to the blog.
This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.