/breach-process

description: GDPR breach notification procedures and 72-hour requirement

Breach Notification Process

Guides compliance with GDPR breach notification requirements under Articles 33 (supervisory authority) and 34 (data subjects).

Arguments

• `$1` - Breach severity (optional: low, moderate, high, critical)
• `$2` - Process phase (optional: detection, assessment, notification, documentation)

Definition of Personal Data Breach

**Article 4(12)**: "A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed."

Three Types of Breach

1. **Confidentiality Breach**

• Unauthorized or accidental disclosure
• Unauthorized access
• Examples: Hacking, lost laptop, email to wrong recipient

2. **Integrity Breach**

• Unauthorized or accidental alteration
• Data corruption or modification
• Examples: Ransomware, database manipulation, accidental deletion

3. **Availability Breach**

• Accidental or unauthorized loss of access
• Destruction of data
• Examples: Ransomware, DDoS, system failure, natural disaster

**Note**: A single incident can involve multiple breach types

The 72-Hour Rule (Article 33)

Notification to Supervisory Authority

**Obligation**:

• Notify supervisory authority **without undue delay**
• **Within 72 hours** of becoming aware (where feasible)
• If >72 hours, must explain delay

**"Becoming Aware"**:

• When reasonable degree of certainty breach occurred
• Not when initially suspected
• Clock starts when controller has information to conclude breach likely
• Ongoing investigation does not pause clock

When Notification NOT Required

**Exception** (Article 33(1)):

• Breach is **unlikely to result in a risk** to rights and freedoms of individuals

**Risk Assessment Factors**:

• Type and volume of data
• Ease of identification
• Severity and likelihood of consequences
• Special characteristics of data subject (vulnerable individuals)
• Special characteristics of controller (healthcare, financial)
• Number of affected individuals

Notification Content (Article 33(3))

**Minimum Required Information**:

1. **Nature of breach**

• Categories of data subjects affected
• Approximate number of data subjects
• Categories of personal data records
• Approximate number of records

2. **Contact point**

• Name and contact details of DPO or other contact
• Where more information can be obtained

3. **Likely consequences**

• Describe likely consequences of breach
• Potential adverse effects on individuals

4. **Measures taken/proposed**

• Measures taken to address breach
• Measures to mitigate adverse effects
• Remediation steps

Phased Notification

**Article 33(4)**: If information not available within 72 hours:

• Provide initial notification with available information
• Provide additional information in phases "without undue further delay"
• Explain reasons for delay

**Typical Phased Approach**:

1. **Initial (<72h)**: Breach type, approximate scope, contact point 2. **Update 1 (1-2 weeks)**: Confirmed numbers, detailed consequences 3. **Final (ongoing)**: Remediation complete, lessons learned

Notification to Data Subjects (Article 34)

When Required

**Mandatory notification if**:

• Breach likely to result in **high risk** to rights and freedoms

**High Risk Factors**:

• Special category data (health, biometric, racial, etc.)
• Financial data (credit cards, bank details)
• Credentials (passwords, especially if not hashed)
• Large-scale breach
• Vulnerable data subjects (children)
• Significant adverse effects (discrimination, identity theft, financial loss, reputational damage)

Notification Content

**Communicate in clear and plain language**:

1. **Nature of breach**: What happened 2. **Contact point**: DPO or contact for more information 3. **Likely consequences**: Potential impacts on individuals 4. **Measures taken/proposed**: Steps to mitigate 5. **Recommended actions**: What individuals should do (change passwords, monitor accounts, etc.)

Timing

• **Without undue delay**
• No specific deadline (unlike 72-hour rule for authority)
• As soon as possible after discovery
• May notify authority first to seek guidance

When Notification NOT Required

**Exceptions** (Article 34(3)):

1. **Appropriate safeguards applied** (Article 34(3)(a))

• Encryption or pseudonymization rendered data unintelligible
• Example: Stolen encrypted laptop with strong encryption

2. **Subsequent measures taken** (Article 34(3)(b))

• Controller took measures ensuring high risk no longer likely
• Example: Deleted data before unauthorized party accessed it

3. **Disproportionate effort** (Article 34(3)(c))

• Public communication or similar measure
• Equally effective
• Example: Cannot identify/contact affected individuals, public notice instead

Methods of Communication

**Direct Individual Notification**:

• Email (preferred if available)
• Mail (postal)
• Phone
• SMS
• In-app notification

**Public Communication** (if disproportionate):

• Press release
• Website notice (prominent)
• Social media
• Paid advertising

Breach Response Process

Phase 1: Detection and Containment (Hours 0-4)

**Immediate Actions**:

1. **Detect and verify** breach occurred 2. **Contain** breach (stop ongoing unauthorized access) 3. **Preserve evidence** (logs, forensic data) 4. **Assemble response team** (IT, security, legal, DPO, communications) 5. **Initial assessment** of scope and severity

**Key Questions**:

• What happened?
• When did it occur?
• Is it ongoing?
• What systems/data affected?
• How many individuals potentially affected?

Phase 2: Assessment (Hours 4-24)

**Detailed Investigation**:

1. **Root cause analysis**: How did breach occur? 2. **Scope determination**: What data accessed/lost/altered? 3. **Impact assessment**: What are c