Legal obligations

Data breach, cyberattack: who must report what, country by country.

In the European Union, a personal data breach is notified to the data protection authority within 72 hours where feasible (GDPR, Article 33). In Switzerland, the report to the Federal Data Protection and Information Commissioner (FDPIC) is made "as quickly as possible", with no number of hours. The 24-hour cyberattack reports (NIS2 in the Union, the National Cyber Security Centre in Switzerland) only concern specific sectors. The table gives the rule, the deadline and the authority for each text.

The four texts in a single table

Each row links to the official text. The amounts are the maximums written in the law, not typical fines.

Text	Who is concerned	Deadline	Who to report to	Penalty set out in the text
FADP (Switzerland) Data Protection Act, Art. 24	Any controller, so any company that processes personal data, in the event of a data security breach that is likely to lead to a high risk for the persons concerned.	"As quickly as possible". No number of hours in the law.	To the FDPIC, through the DataBreach form. To the persons concerned if their protection requires it or if the FDPIC asks for it. A processor reports to its client.	Fine of up to CHF 250,000 for the private person who wilfully fails to comply with the minimum security requirements (Art. 61, on complaint) or with a decision of the FDPIC (Art. 63).
Report to the NCSC (Switzerland) Information Security Act, Art. 74a to 74h	The authorities and organisations listed in Art. 74b: energy, drinking water, transport, banks and insurance, hospitals, laboratories, telecommunications, cloud computing and data centres, among others. The ordinance provides exceptions for small companies.	24 hours after the cyberattack is detected. 14 days to complete the report.	To the National Cyber Security Centre (NCSC), through the Cyber Security Hub or the reporting form.	Fine of up to CHF 100,000 for anyone who wilfully fails to comply with a decision of the NCSC (Art. 74h).
GDPR (EU) Art. 3, 33, 34, 83	Every company established in the Union. A company with no establishment in the EU is also subject to it if it offers goods or services to people who are in the Union, or monitors their behaviour (Art. 3(2)).	Without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk.	To the competent supervisory authority (in France, the CNIL). To the persons concerned if the risk is high. A processor notifies its client.	Administrative fine of up to EUR 10,000,000 or, for an undertaking, 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)).
NIS2 (EU) Directive (EU) 2022/2555	"Essential" and "important" entities in the sectors listed in Annexes I and II, from the size of a medium-sized enterprise, that carry out their activities in the Union. A few activities are covered whatever their size (Art. 2).	Early warning within 24 hours, notification within 72 hours, final report no later than one month afterwards (Art. 23).	To the CSIRT or the competent authority of the Member State concerned.	Maximum of at least EUR 10,000,000 or 2% of worldwide turnover (essential entities), of at least EUR 7,000,000 or 1.4% (important entities), Art. 34.

Do I have 72 hours to report a data breach in Switzerland?

No. The 72-hour deadline comes from the European GDPR. Article 24 of the Swiss Data Protection Act asks for a report "as quickly as possible", with no figure. The report must state at least the nature of the breach, its consequences and the measures taken or planned.

Not every breach has to be reported. The FDPIC specifies that only those likely to lead to a high risk to the personality or the fundamental rights of the persons concerned must be. It publishes guidelines on this notion of high risk.

The 72 hours only concern you if the GDPR applies to your processing: for example if you sell to individuals in France or Germany, or if you are the processor of a European client which itself has to notify its authority.

In Switzerland, must my company report a cyberattack to the NCSC within 24 hours?

Only if it is on the list in Article 74b of the Information Security Act. The obligation has been in force since 1 April 2025 and targets operators of critical infrastructure. The NCSC states it clearly: for companies that are not part of critical infrastructure, there is currently no legal obligation to report cyber incidents. Voluntary reporting remains recommended.

A simple three-question test:

Is your activity on the list in Art. 74b (energy, water, transport, health, finance, telecommunications, cloud computing, etc.)?
If so, do you fall under an exception in the Cybersecurity Ordinance provided for small companies?
If in doubt, ask the NCSC: the law requires it to inform you and, on request, to issue a ruling (Art. 74a).

Watch out for the case of the IT provider. According to the NCSC FAQ, if you suffer an attack and your clients are critical infrastructure, a report is expected.

What is the difference between the NCSC report and the data protection report?

They do not protect the same thing. The data protection report protects the people whose data leaked: it goes to the FDPIC. The report to the NCSC serves to spot attack patterns against critical infrastructure early and to warn other possible victims. A single attack can trigger both. The NCSC form lets you ask for the report to be forwarded to the FDPIC.

Neither one is a criminal complaint. For that, you have to go to the cantonal police.

Swiss company with clients in the EU: GDPR and NIS2

NIS2 is a directive: each Member State transposes it into its law and designates its authorities. As a general rule, it does not apply directly to a small company established in Switzerland that does not carry out in the Union an activity covered by the text. It reaches you through your clients. Article 21 requires regulated entities to manage "supply chain security", including the relationship with their direct suppliers and service providers. In practice, your European client sends you a security questionnaire or adds clauses to your contract.

On the GDPR side, if you process data for a European client, expect to have to notify it of any breach "without undue delay" (Art. 33(2)) and to prove your security measures.

And in France?

The GDPR applies directly. A personal data breach is notified to the CNIL without undue delay and, where feasible, within 72 hours, when it presents a risk for the persons concerned. For NIS2, the national cybersecurity agency ANSSI follows the transposition and publishes the applicable texts and requirements. Check the state of progress on its page before committing by contract.

And in Belgium?

The GDPR applies directly. A personal data breach is notified to the Data Protection Authority (APD/GBA) without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless it is unlikely to result in a risk. The notification is made through the authority's portal, in one of the three national languages. Notifications sent by email are not processed.

NIS2 is transposed by the law of 26 April 2024 establishing a framework for cybersecurity, known as the NIS2 law, in force since 18 October 2024. "Essential" and "important" entities in the sectors listed in its annexes notify significant incidents to the national CSIRT, the Centre for Cybersecurity Belgium (CCB): early warning within 24 hours, notification within 72 hours (24 hours for trust service providers), final report no later than one month afterwards. They must also register with the CCB. Other companies can write to the CCB, see the first hour.

And in Germany and Austria?

The GDPR applies there as it stands: same 72-hour deadline, same risk logic. Only the authority changes. In Austria, the notification goes to the Data Protection Authority (Datenschutzbehörde), which provides an online form. In Germany, private companies generally come under the data protection authority of their federal state: the list is published by the Federal Commissioner (BfDI).

NIS2 is transposed into national law in both countries:

Germany: the BSI Act (BSIG, Section 32), in force since 6 December 2025. "Particularly important" and "important" entities send an early initial report within 24 hours, a report within 72 hours and a final report no later than one month afterwards, to a joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection (BBK). Registration is done on the portal of the BSI, which also offers a check to find out whether you are concerned.
Austria: the NISG 2026 act, applied since 1 October 2026 by the new Federal Office for Cybersecurity (Bundesamt für Cybersicherheit). "Essential" and "important" entities send an early warning to their CSIRT within 24 hours, notify within 72 hours and submit a final report no later than one month afterwards.

To find out whether your company falls into these categories, check with the authority: the thresholds and the sectors are set by each national law.

What these texts expect from your security

These texts ask for the same thing in different words: technical and organisational measures appropriate to the risk (FADP Art. 8, GDPR Art. 32, NIS2 Art. 21). The GDPR even mentions "a process for regularly testing, assessing and evaluating the effectiveness" of these measures.

To find out where you stand: the Ryze Cyber free scan, a 10-question questionnaire.
To test: the Red Team tries to get in, within a signed framework, and delivers a report ranked by severity. See how a penetration test runs.
To hold over time: the Blue Team hardens access and backups and checks every month. See Red Team and Blue Team.

This page explains the general rule and cites the texts. It is not legal advice. For your own case, check with the authority of your country or with a lawyer.

Frequently asked questions

Does the Swiss Data Protection Act impose a 72-hour deadline?

No. Article 24 of the Swiss act asks for a report to the FDPIC "as quickly as possible", with no number of hours. The 72 hours come from Article 33 of the GDPR and only apply if that regulation concerns you.

In Switzerland, must an ordinary small business report a cyberattack to the NCSC?

No, unless it operates a critical infrastructure listed in Article 74b of the Information Security Act. For other companies, the NCSC states that there is no legal obligation. It recommends voluntary reporting.

Who risks the CHF 250,000 fine set out in the Swiss Data Protection Act?

The criminal provisions of the act target private persons who act wilfully, for example by failing to comply with the minimum security requirements. If the fine does not exceed CHF 50,000 and the investigation needed to identify the person would be disproportionate, the authority may sentence the company instead (Art. 64).

Does NIS2 apply to a small Swiss company?

Not directly in the general case: the directive targets entities active in the Union, from the size of a medium-sized enterprise, in specific sectors. It reaches you by contract, because your regulated clients have to secure their supply chain.

Do you also have to inform the people whose data leaked?

Under Swiss law, yes when it is necessary for their protection or when the FDPIC requires it. Under the GDPR, yes when the breach is likely to result in a high risk to their rights and freedoms.

Not sure where you stand?

The Ryze Cyber free scan is a 10-question questionnaire. It takes two minutes, the score appears straight away and nothing is tested on your systems.

Take the free scan →

Sources

Last updated: 8 October 2026