A data breach at an online service where you have an account does not automatically mean that your account has been taken over. You should still act now, because names, email addresses and passwords are useful for phishing emails and fraud attempts. This guide explains what the provider has to do, which data is especially sensitive and the order in which you should respond.
Short answer: When a provider reports a data breach, change the password of the affected service first, and then every other account where you used the same password. Under Article 34 GDPR, the provider must notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms. Last updated: November 2026.
The most important points at a glance
- A data breach does not automatically mean your account has been taken over. Check it actively anyway.
- Article 34(1) GDPR obliges the provider to notify affected persons without undue delay if the risk is high.
- Notification can be unnecessary, for example if the data was effectively encrypted (Article 34(3)(a) GDPR).
- Change the password of the affected service immediately, along with every other account where you used the same password.
- Where the service offers it, enable two-factor authentication and review the devices that are signed in.
- Watch closely for emails about the incident in the coming weeks, because fraudsters exploit such reports.
What a data breach means legally
The law does not speak of a data leak but of a breach of the security of personal data. Article 34 GDPR carries exactly this heading and sets out when the controller, meaning the provider, must inform the people concerned. The duty therefore rests with the provider and not with you. You receive the information only if the provider classifies the situation as a serious risk.
This has a practical consequence: a missing letter or email is not proof that your data was safe. If you wait for a notification, you lose valuable time. With passwords in particular, every day that an old login still works counts.
When the provider has to notify you
Under Article 34(1) GDPR, the controller notifies the data subject without undue delay if the breach is likely to result in a high risk to their personal rights and freedoms. Without undue delay means without culpable hesitation. The exceptions in paragraph 3 explain why you may receive no personal message even though an incident has happened.
| Situation | Standard under Article 34 GDPR | What you do with it |
|---|---|---|
| High risk, for example access data or identity data in plain text | Notification without undue delay (para. 1) | Check the provider’s email immediately and act |
| The data was effectively encrypted | No notification required (para. 3(a)) | Change your password anyway if you see other warning signs |
| The provider took countermeasures so the high risk no longer exists | No notification required (para. 3(b)) | Watch for unusual access in your account |
| Individual notification would involve disproportionate effort | Public announcement or similar measure (para. 3(c)) | Watch for announcements from the provider |
The table shows the statutory exceptions. They release the provider from sending you a personal message, not from investigating the incident internally. A missing email is therefore no reason for inaction for you. If you know that a service where you hold an account is affected, you can protect yourself without waiting.
Which data is especially sensitive
Not every data breach endangers you to the same degree. What matters is which information has leaked and what it can be misused for. The overview below helps you assess the situation before you act.
| Type of data | Typical risk | What you do |
|---|---|---|
| Name and email address | Targeted phishing emails that look genuine | Do not click links and check the sender |
| Password, even if encrypted or hashed | Takeover of other accounts if the password is reused | Change the password of the service and of every identical password |
| Bank or credit card details | Wrong debits and payment fraud | Contact your bank or card issuer and check transactions |
| Identity or social insurance data | Identity misuse | Inform your bank and the responsible authorities if you suspect misuse |
The combination of name, email address and password is particularly dangerous. With these details, attackers can try logins on other services, and they send messages that refer to real processes. If only your address has leaked, the problem is usually smaller.
Changing the password: why a new password alone is often not enough
A new password for the affected service is the first step. It does not protect you from fraudsters who work with real data from the breach. Therefore also check whether you used the old password anywhere else. A password manager helps you use a separate, long password for each service without memorising it, as the guide on password managers and VPNs for students explains (in German).
If you notice that someone has already been active in your account, for example through unfamiliar sign-ins, changed email addresses or messages sent in your name, this is a different case. Then the issue is no longer only leaked data but the loss of control over the account. For that, follow the steps in the guide on hacked accounts (in German).
Which rights do you have against the provider?
Regardless of any notification, you can ask the provider for information about which data it has stored about you. You can also have it checked whether data that is no longer needed must be deleted. The guide on the right to erasure (in German) describes how this works in practice.
If a data protection violation has caused you damage, for example a fraud that became possible with the leaked data, a claim for damages may come into consideration. The requirements must be checked case by case. The guide on damages after a data protection violation (in German) gives an overview.
If you doubt how the provider has responded, you can turn to the competent data protection supervisory authority. The guide on filing a data protection complaint (in German) explains how a complaint works.
Recognising phishing after a data breach
After a publicly known data breach, fraudsters exploit the situation. They may write that you must confirm your account immediately and refer to the incident. Even if the message looks genuine, do not open links from it. Instead, go directly to the service’s page through the address you have saved or through the app.
Reputable providers usually do not ask you to enter your password through a link in an email. When in doubt, signing in directly is the safer option. If you cannot assign the email, do not delete it hastily. Keep it in case you want to report it or have it checked.
Frequently asked questions
Do I have to change my password immediately after a data breach?
If you use the password of this service, you should change it without delay. Just as important is replacing it in every other service where you used the same password. From the outside you often cannot tell how the provider stored the password, so changing it is the safer decision.
Will the provider always notify me?
No. Under Article 34(1) GDPR the duty applies only where a high risk is likely. Paragraph 3 names three cases in which the personal notification can be dispensed with. A missing message therefore does not automatically mean that nothing has happened. If you have concrete indications, you can ask the provider which categories of data are affected.
Can I claim money because of a data breach?
A claim for damages generally requires a concrete loss, for example a financial loss through fraud. Whether the requirements are met depends on the individual case. Document any losses, dates and correspondence with the provider before you assert a claim.
What do I do if I cannot assign the email?
First check whether you have an account with the named service at all. If you do not, ignore the message and report it as phishing where possible. If you do have an account, open the site through the saved address and check whether the provider has published an official notice.
Do I have to report the data breach myself?
As a data subject you generally do not have to report anything to an authority. If you consider the provider’s handling of the incident faulty, you can complain to the competent data protection supervisory authority. That is an option, not an obligation.
What to do now
- Check whether you have an account with the affected service and open the site only directly through your saved address or the app.
- Change the password of the service and every other password you used there as well.
- Enable two-factor authentication where it is offered and review signed-in devices and forwarding rules.
- Watch for phishing in the coming weeks and note any unusual debits or messages.
Related guides
- Digital rights in everyday life: the overview for students
- Hacked account: what you can do
- Right to erasure: how to have data removed from online services
- Checking app permissions: which access an app really needs (in German)
Sources: Article 34 GDPR, text of Regulation (EU) 2016/679, retrieved via gesetze.legal, November 2026.
Last updated: November 2026. This guide is general information, not individual advice.
