Contain the breach and keep the record your regulator expects.
Under GDPR, ransomware becomes a personal data breach the moment it locks or exposes personal data. That starts a 72-hour clock to notify your supervisory authority, unless the breach is unlikely to put people at risk, and every breach must be documented. Helm contains ransomware at the data layer and records which accounts, devices and files were involved, so you can assess the risk and report with facts.
Personal data breaches are rising. Across Europe, supervisory authorities received an average of 443 breach notifications a day between January 2025 and January 2026, up 22% on the year before, and fines held at about €1.2 billion.
Ransomware sits right in the middle of GDPR. Encrypting personal data takes away access to it, which the European Data Protection Board treats as a breach of availability. When attackers also copy data before encrypting it, confidentiality is breached too.
The pressure comes quickly. Within hours, you need to know whose data was affected, whether it left your network and how soon access is back. Without those facts, the 72-hour deadline becomes guesswork.
Usually, yes. GDPR defines a personal data breach as a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)). Ransomware that encrypts files holding personal data meets that definition, even if nothing is stolen.
GDPR applies to every organisation established in the EU or EEA that processes personal data, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. That covers customer, employee and patient data alike. The UK has its own UK GDPR, which follows the same rules.
Both controllers, who determine why and how data is processed, and processors, who handle it on their behalf, carry duties. A processor hit by ransomware must tell the controller without undue delay.
Article 32 asks for security that fits the risk, including the ability to restore access to personal data in a timely manner after an incident, and regular testing of those measures.
Article 33 sets the GDPR breach notification rule. You notify your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. The notification describes what happened, the categories and rough numbers of people and records involved, the likely consequences and the measures taken. Information can follow in phases.
Article 34 adds a duty to tell the people affected when the risk to them is high. And under Article 33(5), you document every breach, reported or not. A ransomware incident can also be reportable under NIS2.
A GDPR notification is only as good as the facts behind it. Helm gives your data protection team those facts from the first second of an attack, while you stay in charge of the assessment and what is reported.
What was affected. Helm detects active encryption in under a second and records the accounts, devices, file paths and actions involved, with a timestamp for each. Its logs show whether personal data was accessed, encrypted or exfiltrated, which is the starting point for your risk assessment. [TBC]
What was done. Helm isolates the compromised accounts and devices on fixed, readable rules your team sets, with no AI in containment, so the breach stays as small as possible. Every action lands in the same record.
How access came back. Helm verifies that systems are clean before they return, supporting the timely restore Article 32 asks for. For high-risk processing, Helm can be named as a mitigation measure in your data protection impact assessment. [TBC]
GDPR asks you to protect personal data, bring access back quickly and be open about what went wrong. Helm gives you control over the first two and the facts for the third, so every notification, and every breach you document without reporting, rests on evidence.
Patient data raises the stakes further. To see what the record looks like for your organisation, talk to us.
