Data on external media was misplaced and all the protocols to report it as lost were followed.

A few months after, the media was discovered. It never left the secure location.

Given that data was never lost, how should the case be filed respecting GDPR and DPO legislation?

Precedents I can reference would be of great help.

  • 1
    Because this is very specific to reporting requirements as part of a regulation (GDPR), this belongs on a different site.
    – schroeder
    Commented May 12, 2020 at 9:22
  • 2
    I don't know of precedents, but I'd expect they'd treat the event as a breach. Because someone lost track of the media for several months, it's hard to be sure it never left the secure location.
    – paj28
    Commented May 12, 2020 at 9:28

3 Answers 3


The company believed that some external media was not there anymore, and found it months later exactly in the place where it belonged.

If I was bribed to give a copy of that data to someone, I'd take the media, copy it, sell it to the briber, and return the media where it belonged. Except in this case, everyone is up in arms because the media is gone missing, so I wait until everything goes quiet, and that's when I return the media, a few months later when nobody is watching anymore.

Conclusion: If the external media cannot be found, and then some months later it is found exactly where it belongs, then it is quite likely that it has been copied in between, so that should be treated as a breach.

On the other hand, if the media had been accidentally destroyed (like putting a CD into a broken CD reader can destroy it), that would not be a breach. You'd have to check the exact wording of the GDPR to see if such destruction needs to be reported, but it wouldn't really make sense.

  • 1
    That behavior would be considered wrong in many organizations. Besides the obligation is to report incidents within 72 hours of discovering them. So the "some months later" would be a breach for the regulator.
    – chribonn
    Commented May 3, 2022 at 12:27
  • 1
    The question was about what to do if the media is found months later, exactly where it should have been. Yes, the loss should have been reported much earlier, but the media turning up doesn't fix the problem.
    – gnasher729
    Commented May 3, 2022 at 15:39

The Dutch DPO (Autoriteit Persoonsgegevens, AP) recently clarified that an accidental leak does not require reporting, if the data is leaked to a trustworthy party. In the Dutch case, data was sent to the government by accident. It was accepted that the government deleted the leaked data when informed, undoing the leak.

In your case, finding back the data also undid the leak - the question whether you need to trust an external party doesn't even exist.


The only solution I can foresee is contact all the relevant parties and discuss the situation openly. You can't make the event dissappear but you may be able to control its impact if you can provide evidence that the data was never misplaced.

  • The protocol was followed fully. And following the discovery relevant parties were informed.
    – chribonn
    Commented May 13, 2020 at 7:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .