GDPR data breach: who must be notified?
gdpr_breach_decisionRead-onlyIdempotent
Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| risk | Yes | Likely risk to people's rights and freedoms (EDPB Guidelines 9/2022): consider the type of breach, the sensitivity and volume of the data, how easily people can be identified, how severe the consequences are, and vulnerable people such as children | |
| role | No | Controller decides why and how data are processed; a processor acts on its behalf | |
| hours_since_aware | No | Hours since the controller had a reasonable degree of certainty that a breach occurred | |
| data_unintelligible | No | The affected data were unintelligible to unauthorised people, e.g. state-of-the-art encryption with the key not compromised | |
| individual_contact_disproportionate | No | Contacting each person would involve disproportionate effort, e.g. no contact details | |
| subsequent_measures_remove_high_risk | No | Measures taken since then ensure the high risk is no longer likely to materialise |