Data Breach Handling

What it does

When personal data leaks, you have to move fast and in the right order, often before the facts are clear. Our breach workflow takes you from the first report to closure. It follows Articles 33 and 34 GDPR: tell the supervisory authority within 72 hours of finding out if the breach is likely to put people at risk, and tell the people affected if the risk is high. The 72-hour rule is explained in our Knowledge Base.

The workflow keeps the work organised and the record complete. A lawyer makes the calls on notification.

Functions

Intake and reference

Log a breach as soon as you know about it, in the client portal or through us. It gets a reference and a note of when the organisation became aware, which is when the 72 hours start to run.

72-hour countdown

A countdown shows how much time is left to notify the supervisory authority, visible to everyone working on the breach. It supports the lawyer's calculation; a person always confirms the date.

Assessment of the breach

Structured questions capture what happened (confidentiality, integrity, availability), which categories and roughly how many people and records are involved, the likely consequences and what has been done. The risk to individuals, and whether it is high, is recorded with the reasoning. If the incident also falls under NIS2, the same facts support the separate report to the national cybersecurity authority; the lawyer decides on that.

Notification to the authority

We arrange the facts in the file into what Article 33(3) asks for: nature of the breach, contact point, likely consequences and measures. If you don't have everything yet, the notification can go in phases. A lawyer approves each version before it is submitted.

Information to individuals

When the risk is high, we prepare the message to the people concerned in plain language, with the information Article 34(2) lists. A high-risk breach can't be closed until those people have been informed or the reason for not informing them is recorded, for example that encryption made the data unreadable, or that later measures mean the risk is no longer likely to materialise.

Breach register and follow-up

Every breach, notified or not, stays in the register, as Article 33(5) requires. Tasks, owners and deadlines are tracked, and lessons learned can be linked to entries in your record of processing.

What you receive

• A breach file with reference, timeline, assessment, decisions and the reasoning behind them.
• A notification to the authority and, where needed, a message to individuals, both approved by a lawyer.
• A task list with owners for containment and fixes.
• A breach register you can export and show to the authority.

Example walk-through

Say the receptionist at a dental practice reports on a Tuesday morning that a laptop was stolen from a car. The practice logs it in the portal, which creates a reference and starts the countdown from the moment the practice learned of the theft. The questions record that the laptop held patient files, the disk was encrypted and the last backup was current. The lawyer assesses it: health data, but encryption makes access unlikely, so the risk to patients is low. No notification to the authority or the patients, and the reasoning is stored in the register. Had the disk not been encrypted, the workflow would have prepared the notification and patient messages for the lawyer's approval, and the file couldn't have been closed until the patients were informed or the reason was recorded.

That same file keeps working for you: it answers the authority if it asks how the decision was reached, it feeds the review of your security measures, and it shows your board the incident was handled in an orderly way.

Where it is used

The workflow is the core of our data breach response service and a standing part of DPO as a Service. If affected people send access or erasure requests, you can handle them through data subject requests. Our platform is hosted in the EU. Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out.