After notifying the supervisory authority, what should be the first action the controller must take when it finds a security breach where unauthorized people have accessed personal data?

After the initial notification to the supervisory authority, which must be done within 72 hours, the controller has an ongoing obligation to investigate the breach fully. A critical component of this investigation is to assess the level of risk posed to the rights and freedoms of the affected individuals. Determining whether sensitive (special category) data has been accessed is fundamental to this risk assessment. The outcome of this analysis directly informs the controller's next legal obligation under GDPR Article 34: whether the breach is likely to result in a high risk that necessitates notifying the data subjects themselves.

A. Contact the DPO for formal notification to the Supervisory Authority. This action is out of sequence. The question states the supervisory authority has already been notified, and the DPO should have been involved from the moment the breach was discovered.
C. Register a Police Report at the cybercrime station. While potentially advisable if a crime has occurred, this is not a mandatory first step under data protection law. The primary obligation is to manage the data protection implications.
D. Notify data subjects that have been subject to a security breach. This action is premature. The decision to notify data subjects depends on a risk assessment, which must first determine if the breach is "likely to result in a high risk."

1. General Data Protection Regulation (EU) 2016/679, Article 34(1): "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay." This establishes that a risk assessment must precede notification to data subjects.

2. European Data Protection Board (EDPB), Guidelines 01/2021 on Examples regarding Data Breach Notification, Version 2.0 (14 January 2022), p. 6, para. 14: "In order to determine the level of risk, the controller should conduct an objective assessment, based on a number of factors... For example, the type of breach, the nature, sensitivity, and volume of personal data..." This confirms that analyzing the sensitivity of the data is a core part of the risk assessment process.

3. General Data Protection Regulation (EU) 2016/679, Article 33(4): "The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken." This implies a continuous process of investigation and analysis following the initial discovery and notification.