What do I have to do if my website has a data breach?
The short answer
Contain it first: change passwords, revoke leaked keys and fix the hole. Then work out whose data was exposed and how serious the risk is, because many privacy laws set deadlines for telling the regulator and the people affected — 72 hours under the GDPR and UK GDPR, for example. Keep a written record of what happened and what you did.
Applies in EU · UK · Australia · US
Straight away
- Change passwords and revoke any API keys that may have leaked, starting with your email, registrar and hosting.
- Close the hole: update the software, remove the malicious code, or restore a clean backup.
- Write down what happened, when you found it and what data was involved.
Deadlines to know
| Law | Deadline |
|---|---|
| GDPR and UK GDPR | Tell the regulator within 72 hours of finding a breach that risks people’s rights; tell the people affected without undue delay if the risk is high. |
| Australian Privacy Act | Assess a suspected breach within 30 days; if serious harm is likely, notify the OAIC and the people affected as soon as practicable. |
| HIPAA (US health data) | Notify affected people within 60 days, and HHS (and sometimes the media) depending on how many are affected. |
| FTC Safeguards Rule (US financial) | Notify the FTC within 30 days if unencrypted information about 500 or more consumers is taken. |
All 50 US states, plus Washington DC, Guam, Puerto Rico and the US Virgin Islands, have their own breach-notification laws. Deadlines and thresholds depend on where the affected people live.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- Data breach
- Personal data lost, stolen or seen by someone who shouldn’t see it. Many laws require you to report serious breaches within days.
- Rotating keys
- Replacing a secret key with a new one and switching off the old one, so anyone who had the old key is locked out.
- GDPR (European Union)
- Europe’s privacy law. It applies if you handle personal data of people in the EU — even if your business is elsewhere.
- Australian Privacy Act
- Australia’s main privacy law, built around 13 Australian Privacy Principles. Health businesses are covered whatever their size.
- HIPAA (United States)
- US law protecting health information handled by healthcare providers, insurers and the companies that serve them.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.