Notification of a personal data breach to the supervisory authority

When a data breach occurs, Article 33 of the GDPR requires prompt and proper notification to supervisory authorities. Here's a practical framework to ensure your business can respond effectively within the tight 72-hour timeline.

Creating Your Breach Response Protocol

1. Establish a Detection System

Set up technical tools and train staff to identify potential breaches:

• Implement intrusion detection systems

• Configure alerting for unusual data access patterns

• Create simple channels for staff to report suspicious activities

• Monitor system logs for unauthorized access attempts

2. Form a Breach Response Team

Define clear roles and responsibilities:

• Incident Lead: Coordinates the overall response

• Technical Investigator: Determines breach scope and cause

• Legal Advisor: Assesses legal obligations

• Communications Manager: Prepares notifications

• Remediation Manager: Implements corrective measures

3. Create Notification Templates

Develop pre-approved templates containing:

• Company details and DPO contact information

• Structured sections for required information

• Placeholders for breach-specific details

• Format aligned with your supervisory authority's preferences

4. Design a 72-Hour Action Plan

Break down the timeline into manageable phases:

• 0-24 hours: Detect, contain, initial assessment

• 24-48 hours: Complete investigation, impact assessment

• 48-72 hours: Final review and notification submission

Executing the Response

Step 1: Initial Assessment (0-24 hours)

Upon breach detection:

• Contain the breach to prevent further data exposure

• Collect preliminary information about affected systems

• Make an initial risk assessment

• Alert key team members

• Document discovery time to establish the 72-hour deadline

Step 2: Investigation & Documentation (24-48 hours)

Gather the information required for notification:

• Categories and approximate number of affected data subjects

• Types and approximate volume of compromised records

• Technical circumstances of the breach

• Potential consequences for individuals

• Document all findings in a breach log

Step 3: Notification Preparation (48-72 hours)

Compile a compliant notification that includes:

• Clear description of the breach nature

• DPO or alternative contact details

• Assessment of likely consequences

• Measures taken to address and mitigate the breach

• Timeline for providing additional information if not all details are available

Step 4: Submission

Submit the notification through the appropriate channel:

• Use your supervisory authority's preferred method (online portal, email)

• Keep proof of submission

• Prepare for follow-up questions

Practical Risk Assessment Framework

Develop a simple scoring system to assess if notification is required:

1. Data sensitivity (1-5)

2. Volume of affected records (1-5)

3. Ease of identifying individuals (1-5)

4. Potential for harm (1-5)

5. Containment status (1-5)

Total score above 15 generally indicates notification is required.

Documentation Requirements

Maintain a breach register containing:

• Date and time of breach discovery

• Breach details and scope

• Risk assessment results

• Notification decision rationale

• Copy of submitted notification

• Details of remedial actions

• Lessons learned