GDPR · pillar 4 of 6
Personal data breaches
Two different thresholds, two different clocks, and a log that covers every breach either way.
- 10 72 hours, from awareness A personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it…
- 11 Two thresholds, two audiences The authority is notified when a breach is likely to result in a risk; the data subjects are told only when it is…
- 12 Log every breach, including the ones you do not report Every personal data breach must be documented — facts, effects, remedial action — whether or not it was notified. The…
Start this pillar See the whole map
Read against Regulation (EU) 2016/679 (GDPR), Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.