Lithuania’s Regulator Publishes a Method for Rating Data Breach Risk: How to Use It in the First 72 Hours

Every data breach under the GDPR forces the same decision within days: is this a breach we only record, one we report to the regulator, or one we also tell the affected people about? Lithuania’s data protection authority, the State Data Protection Inspectorate (ValstybinÄ— duomenų apsaugos inspekcija, or VDAI), has published a recommendation designed to make that decision more consistent. The document, titled “How to assess the risk posed by a personal data breach?” and dated October 26, 2026, gives controllers a method to rate the severity and likelihood of harm and match the result to their notification duties.

The guidance is written for organizations under Lithuanian supervision, but the method follows the GDPR, so it is useful for any controller in Europe trying to make breach decisions it can defend later.

The legal question the guidance answers

The GDPR sets three outcomes for a personal data breach, and the dividing line between them is risk to people’s rights and freedoms.

• No risk likely. Article 33 does not require notification to the authority when a breach is unlikely to result in a risk. The controller must still record it internally under Article 33(5).
• Risk. The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• High risk. Under Article 34, the controller must also inform the affected people without undue delay, unless an exception applies, for example because the data was encrypted and the key was not compromised.

The law does not say how to measure risk. That gap is where controllers disagree, and where regulators often find fault after the fact. Our analysis of rising breach notifications across Europe shows how much volume regulators now handle.

How the VDAI method works

According to the VDAI’s announcement and recommendation (in Lithuanian, translated here), risk is assessed on two axes: how severe the possible harm to people would be, and how likely it is to happen. A matrix combines the two and produces one of three results: no risk, risk, or high risk.

The factors controllers are told to weigh include:

• The sensitivity of the data. Health data, financial data or identity documents raise severity.
• The volume of data and number of people affected.
• How easily people can be identified from the data involved.
• Technical safeguards, such as encryption, that lower the chance the data can be used.
• Vulnerable groups, such as children, whose involvement raises the stakes.

The VDAI also stresses that the assessment must rest on factual and technical evidence and be documented. That point matters most in practice. A rating with no evidence behind it is hard to defend if the regulator later disagrees.

The guidance builds on earlier VDAI material, including an August 2026 note on the 72-hour rule and an October 2026 presentation on breach risk assessment. It is also consistent with the European Data Protection Board’s guidelines on breach notification, which use similar severity and likelihood factors.

A worked approach for your next breach

Here is how a team can apply the method in the first 72 hours. The example is hypothetical.

1. Establish the facts. What data, how many records and people, which systems, and whether the data was viewed, copied, altered or only made unavailable. Example: a misconfigured storage bucket exposed 8,000 customer records with names, emails and order histories for six days.
2. Rate severity. Names and order histories are not special category data, but order histories can reveal habits, and emails enable phishing. A team might rate severity as moderate.
3. Rate likelihood. Access logs show two unknown IP addresses downloaded files. The data was not encrypted. Likelihood is high.
4. Read the matrix. Moderate severity combined with high likelihood would point to at least “risk,” which means notifying the authority, and the team should consider whether it reaches “high risk” for customers.
5. Write it down. Record the facts, the evidence behind each rating, the result and the decision, with a timestamp. Update the record as facts change.

Teams should not wait for perfect facts. The GDPR allows information to be provided in phases. Notifying within 72 hours with what is known, and following up, is better than missing the deadline.

Common mistakes the method helps avoid

• Treating encryption as a blanket exception. It only lowers risk if the encryption was strong and the key was not exposed.
• Counting only records, not people. A small number of records about children or patients can mean high risk.
• Forgetting availability breaches. Ransomware that locks data without stealing it is still a breach and needs an assessment.
• Not recording “no risk” decisions. The internal record is mandatory, and it is the first thing a regulator asks for.

Regulators have fined companies for slow or weak breach handling, as our reports on the French fine against Mobius Solutions, Estonia’s €3 million breach fine and the U.K.’s £14 million Capita fine show. Companies with U.S. operations face a different set of tests, summarized in our U.S. state breach notification resource.

Where Captain Compliance fits

Captain Compliance’s data mapping and records tools help teams know which systems hold which categories of personal data, which speeds up the first step of any breach assessment. Its assessment templates can be used to record severity and likelihood ratings with the evidence behind them. For a full walk-through of breach analysis, see our guide to data breach analysis. Tools structure the decision, but the controller remains responsible for it, and a completed form is not proof that the rating was right.

Frequently asked questions

Is the VDAI recommendation binding?

No. It is guidance. The binding rules are Articles 33 and 34 of the GDPR. Following the guidance helps show a reasoned assessment.

Does every breach have to be reported to the VDAI?

No. Breaches unlikely to result in a risk to people do not need to be reported, but they must be recorded internally.

When must affected people be told?

When the breach is likely to result in a high risk to their rights and freedoms, without undue delay, unless a GDPR exception applies.

What if we cannot finish the assessment in 72 hours?

Notify within 72 hours with the information available and explain that more will follow. Late notifications must include reasons for the delay.

Does the method apply outside Lithuania?

It is written for controllers supervised by the VDAI, but because it follows the GDPR and is consistent with EDPB guidance, controllers elsewhere can use it as a reference.

The record outlasts the breach

Most breaches are forgotten by the public within weeks. The assessment record is not. When a regulator opens a file months later, the question is rarely whether the company made the perfect call. It is whether the company can show how it made the call and why. Lithuania’s guidance is, at bottom, a template for that answer. Controllers that fill it in during the first 72 hours will find the conversation with their regulator much shorter.