--- title: "Data Breach Handling | Pitch" description: "A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a…" url: https://www.pitch.law/technologies/breach-response-workflow --- [pitch](https://www.pitch.law/) [Technology](https://www.pitch.law/technologies) [Privacy, data & AI](https://www.pitch.law/technology-categories/privacy-data-ai) # Data Breach Handling A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer. ## What it does When personal data leaks, you have to move fast and in the right order, often before the facts are clear. Our breach workflow takes you from the first report to closure. It follows Articles 33 and 34 GDPR: tell the supervisory authority within 72 hours of finding out if the breach is likely to put people at risk, and tell the people affected if the risk is high. The [72-hour rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) is explained in our Knowledge Base. The workflow keeps the work organised and the record complete. A lawyer makes the calls on notification. ## Functions ### Intake and reference Log a breach as soon as you know about it, in the client portal or through us. It gets a reference and a note of when the organisation became aware, which is when the 72 hours start to run. ### 72-hour countdown A countdown shows how much time is left to notify the supervisory authority, visible to everyone working on the breach. It supports the lawyer's calculation; a person always confirms the date. ### Assessment of the breach Structured questions capture what happened (confidentiality, integrity, availability), which categories and roughly how many people and records are involved, the likely consequences and what has been done. The risk to individuals, and whether it is high, is recorded with the reasoning. If the incident also falls under [NIS2](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework), the same facts support the separate report to the national cybersecurity authority; the lawyer decides on that. ### Notification to the authority We arrange the facts in the file into what Article 33(3) asks for: nature of the breach, contact point, likely consequences and measures. If you don't have everything yet, the notification can go in phases. A lawyer approves each version before it is submitted. ### Information to individuals When the risk is high, we prepare the message to the people concerned in plain language, with the information Article 34(2) lists. A high-risk breach can't be closed until those people have been informed or the reason for not informing them is recorded, for example that encryption made the data unreadable, or that later measures mean the risk is no longer likely to materialise. ### Breach register and follow-up Every breach, notified or not, stays in the register, as Article 33(5) requires. Tasks, owners and deadlines are tracked, and lessons learned can be linked to entries in your [record of processing](https://www.pitch.law/technologies/privacy-register). ## What you receive - A breach file with reference, timeline, assessment, decisions and the reasoning behind them. - A notification to the authority and, where needed, a message to individuals, both approved by a lawyer. - A task list with owners for containment and fixes. - A breach register you can export and show to the authority. ### Example walk-through Say the receptionist at a dental practice reports on a Tuesday morning that a laptop was stolen from a car. The practice logs it in the portal, which creates a reference and starts the countdown from the moment the practice learned of the theft. The questions record that the laptop held patient files, the disk was encrypted and the last backup was current. The lawyer assesses it: health data, but encryption makes access unlikely, so the risk to patients is low. No notification to the authority or the patients, and the reasoning is stored in the register. Had the disk not been encrypted, the workflow would have prepared the notification and patient messages for the lawyer's approval, and the file couldn't have been closed until the patients were informed or the reason was recorded. That same file keeps working for you: it answers the authority if it asks how the decision was reached, it feeds the review of your security measures, and it shows your board the incident was handled in an orderly way. ## Where it is used The workflow is the core of our [data breach response](https://www.pitch.law/solutions/data-breach-response-enforcement) service and a standing part of [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). If affected people send access or erasure requests, you can handle them through [data subject requests](https://www.pitch.law/technologies/dsar-handling). Our platform is hosted in the EU. Confidential content is redacted on our own hardware before any cloud AI sees it; if that check cannot run, nothing goes out. ## In short - 72-hour countdown from the moment of awareness - Reference and file per breach - Structured notification to the authority - High-risk breaches cannot be closed without a decision on informing individuals - Lawyer approves every notification ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/data-breach-response-enforcement) ### [Data Breach Response](https://www.pitch.law/solutions/data-breach-response-enforcement) [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://www.pitch.law/solutions/data-breach-response-enforcement) ## Background reading - [Academy](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - [Academy](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) ### [The NIS2 Directive](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) [Who falls under NIS2, what the directive requires, how the 24-hour, 72-hour and one-month incident reports work and how they relate to GDPR breach notification.](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) - [Academy](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) ## More in Privacy, data & AI - ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)