Understanding Data Breach Notification

A personal data breach is defined under Article 4(12) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Notification to Supervisory Authority

Under Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

The notification must include:

• The nature of the personal data breach including categories and approximate number of data subjects and personal data records concerned
• The name and contact details of the DPO or other contact point
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its possible adverse effects

Notification to Data Subjects

Article 34 requires organizations to communicate the breach to affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms. This notification must include:

• A description of the nature of the breach in clear and plain language
• Contact details of the DPO or other contact point
• The likely consequences of the breach
• Measures taken or proposed to address the breach

Exceptions to Individual Notification

Organizations are not required to notify individuals if:

• Appropriate technical and organizational protection measures (such as encryption) were in place
• Subsequent measures ensure the high risk is no longer likely to materialize
• It would involve disproportionate effort (in which case a public communication may be made instead)

Record Keeping

All data breaches must be documented, regardless of whether notification is required. This documentation should include facts, effects, and remedial actions taken.