prudenceby Runciter

Walkthroughs · 3.5

Record a personal data breach

The seventy-two hour clock under Article 33, and communication to people under Article 34.

Steps

Article 33 requires notification without undue delay and, where feasible, within seventy-two hours of becoming aware.

  1. 01Record awarenessState the date and time the organisation became aware. The seventy-two hour clock runs from here and is shown on the overview.
  2. 02Describe what happenedRecord the categories and approximate number of data subjects and records concerned, and the likely consequences.
  3. 03Assess notificationRecord whether the supervisory authority must be notified, and whether the risk to people is high enough to require communication under Article 34.
  4. 04Record the measuresState the measures taken or proposed to address the breach and mitigate its effects, and raise privacy actions for the ones still outstanding.
  5. 05Close with the evidenceAttach what was sent to the authority and to the people concerned.
The data breach register, with the seventy-two hour clock.
The data breach register, with the seventy-two hour clock.
← Handle a data subject requestNext: Manage risks and measures ↗