Book a meeting
Menu
Why it matters

When it goes wrong, it lands on you.

A hacked supplier. A locked server. An email to the wrong person. Each one is a personal data breach, and the law gives you hours, not weeks, to act.

12,276personal data breaches were reported to IMY in 2025.Almost 90% more than the year before. The rise was driven by attacks on suppliers that serve many companies.

Be ready before the phone rings.

We put the groundwork in place now, so a bad day doesn't turn into a crisis.

  • You know what data you have, and whereRecord of processing · GDPR Compliance
  • Everyone knows what to do in the first 72 hoursIncident routine · GDPR Compliance
  • You know which AI you use and what appliesAI inventory · AI Compliance
  • It stays up to date as you and the rules changeOngoing Compliance

Ransomware hits on a Monday morning. The clock starts.

  1. Hour 0You find out.Who decides what happens now? Who calls whom? Without a routine, the first hours go to guessing.
  2. Within 24 hoursEarly warning.If you're covered by the Cybersecurity Act, the authority must be warned within a day.
  3. Within 72 hoursReport to IMY.What data, how many people, what you've done about it. Without a record of processing, you can't answer.
  4. Without delayTell those affected.If the breach puts people at high risk, they must hear it from you, not from the news.

Your supplier's breach is your problem

If your IT, payroll or booking provider is hacked, you are still the one who answers for your customers' and employees' data.

A locked system counts too

Ransomware that cuts you off from personal data is a breach, even if nothing leaks.

Management is accountable

Under the Cybersecurity Act, management must be trained in security. In the most serious cases, a court can bar a manager from a leadership role for up to three years.

Fines follow turnover

Up to €20 million or 4% of global turnover under GDPR, and up to 7% for banned AI under the AI Act. People affected can also claim damages.

And the AI you already use?

Most companies use AI long before anyone has checked what it means. The AI Act adds its own rules on top of GDPR. Some already apply, such as AI literacy for staff who use AI, and more are on the way.

Status on 1 November 2026
  1. 2 Feb 2025In force
    Prohibited practices are banned, such as emotion recognition at work
  2. 2 Aug 2026In force
    Transparency rules apply: people must be told when they are dealing with an AI system such as a chatbot
  3. 2 Dec 2026Next
    Technical marking of AI content
  4. 2 Dec 2027Coming
    High-risk systems in areas like hiring and credit
  5. 2 Aug 2028Coming
    High-risk AI built into products

Customer data in a chatbot

When staff paste customer or employee data into an AI tool, that is processing under GDPR. It needs a legal basis, and usually a data processing agreement (DPA) with the provider.

What the AI Omnibus changed

The AI Omnibus (Regulation (EU) 2026/1744) entered into force on 27 July 2026. It moved the deadlines for high-risk AI to December 2027 and August 2028, and extended simplified rules to more mid-sized companies. The transparency rules still apply from August 2026.

Read the European Commission's overview of the AI Omnibus

Sources: IMY, personal data breach reports 2025. GDPR articles 28, 33, 34, 82 and 83. Cybersecurity Act (SFS 2025:1506), chapter 2 sections 4–6 and chapter 4 sections 6–8. EU AI Act articles 4, 5, 50 and 99. AI Omnibus, Regulation (EU) 2026/1744.