Steps
Article 33 requires notification without undue delay and, where feasible, within seventy-two hours of becoming aware.
- 01Record awarenessClick Data breaches in the left menu, press the plus button and choose Data breach. On the Lifecycle tab set Detected at to the date and time the organisation became aware; the seventy-two hour clock runs from there and is shown on the overview.
- 02Describe what happenedOn the Context tab fill in the data subject categories, the personal data categories and Approximate individuals affected, and on Details set Breach type and Cause.
- 03Assess notificationOn the Assessment tab, answer Authority notification required (Art 33) and Individual communication required (Art 34), based on Risk to individuals.
- 04Record the measuresFill in the measures taken or proposed on the Assessment tab, then click New record and choose Privacy action for each one still outstanding, linking it back to this breach.
- 05Close with the evidenceAttach what was sent to the authority and to the people concerned under Closure evidence, then select Closed on the lifecycle bar and click Record as closed.
