Report a data breach (Datenpanne, Art. 33 GDPR)
report_data_breachDestructiveIdempotent
Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without bestaetigung): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus bestaetigung): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| risiko | Yes | Risk to the rights and freedoms of persons as assessed by the organisation; "unklar" if not yet assessed | |
| uebung | No | true = practice case (drill): no deadline reminders, no notifications | |
| sprache | No | Output language. Default: German if the input is German, otherwise English. | |
| massnahmen | No | Measures already taken | |
| entdeckt_am | Yes | When the organisation became aware of the breach, ISO 8601 with time zone (e.g. 2026-10-28T09:30:00+01:00). Starts the 72-hour deadline. Not in the future. | |
| vorfall_typ | Yes | Type(s) of incident | |
| beschreibung | Yes | What happened, in plain words (20–4,000 characters). Avoid names of affected persons. | |
| bestaetigung | No | Value from the preview. Omit it to get the preview; send it unchanged to create the breach. | |
| anzahl_unbekannt | No | true if the number of affected persons is not yet known | |
| betroffene_daten | No | Categories of personal data affected | |
| anzahl_betroffene | No | Approximate number of affected persons | |
| kategorien_personen | No | Categories of data subjects |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| frist | Yes | End of the 72-hour reporting deadline (UTC) | |
| felder | No | ||
| uebung | Yes | ||
| schritt | Yes | ||
| app_link | No | ||
| meldeweg | No | ||
| breach_id | No | ||
| wiederholt | No | ||
| gueltig_bis | No | ||
| bestaetigung | No | ||
| benachrichtigt | No | ||
| entwurf_meldung | No | Draft for the report under Art. 33(3) GDPR, in the order of the authority form | |
| behoerde_freitext | No | ||
| wird_benachrichtigt | No | ||
| zustaendige_behoerde | No | ||
| fehlende_pflichtfelder_der_behoerde | No |