A data breach is any loss, disclosure, alteration of, or unauthorised access to personal data: a stolen laptop, an email sent to the wrong recipient, ransomware, a database exposed on the internet. The GDPR requires you to record all of them in a register (Article 33(5)), even those that are not notified, and, unless the risk is unlikely, to notify the supervisory authority within 72 hours of becoming aware of them.
The register is under Data protection › Data breaches. It is reserved for data protection officers and administrators.
Record the breach
- Click New breach.
- Give it a title and state your role: controller (the data is yours) or processor (you process a client's data).
- Enter when you became aware: the moment you had reasonable certainty that a breach occurred. This is the start of the 72 hours.
- Describe what you know: nature (confidentiality, integrity, availability), what happened, people and data concerned with their approximate number, likely consequences, measures taken. You can complete it later.
- If relevant, link the major incident, tickets, affected assets and the activities of the processing register.
From an incident: on a ticket, the Open a personal data breach button opens a record already linked to the ticket, with its number and title. On a major incident, the Personal data breach panel does the same and lists the breaches already opened from that incident. The button and the panel are shown only to data protection officers and administrators.
As soon as it is recorded, the record shows the 72-hour deadline and the time left. Data protection officers receive a notice, then an alert when less than 24 hours remain, less than 6 hours, and when the deadline has passed.
Assess the risk
Under Risk assessment, choose risk unlikely, risk or high risk, and write your reasoning: nature and volume of the data, how easily people can be identified, vulnerable people, whether the data was encrypted. The reasoning is kept: the authority may ask for it, even for a breach that was not notified.
- Risk unlikely: no notification. The breach stays in the register.
- Risk: notification to the authority.
- High risk: notification to the authority and communication to the people concerned.
Notify the authority
- Download the PDF record: it contains everything Article 33(3) requires (nature, categories and numbers, DPO contact, consequences, measures).
- File the notification with your country's authority.
- Come back to the record and save the notification to the authority: date, authority, filing reference, filing receipt attached.
After 72 hours, first enter the reasons for the delay in the facts: the notification cannot be saved without them.
If you did not have everything when you filed, add an additional notification for each new piece of information.
Are you a processor? You do not notify the authority: notify each client concerned without undue delay and record one notice per client. The client assesses the risk and notifies.
Inform the people concerned
When the risk is high, record your decision under Communication to the data subjects:
- Individual: paste the people's email addresses (one per line) and click Send. Each person receives their own email (template “Data protection - Breach communication to a data subject”, which you can adapt). Only the number of emails sent is kept. A communication sent by post is recorded with its proof.
- Public: when informing everyone would involve a disproportionate effort, record the public communication you made (press release, website page) with its proof.
- Exception: the data was unintelligible (strong encryption, key not compromised), or measures taken since make the high risk unlikely. Justify it.
Close the record
Close the record is only possible once everything is done: risk assessed, authority notified (unless the risk is unlikely), reasons for any delay, clients notified (processor), communication made or exception justified (high risk). The record lists what is missing.
A closed record stays in the register, under the All tab. It can be reopened with a reason if new facts emerge.