Log every breach, including the ones you do not report
Every personal data breach must be documented — facts, effects, remedial action — whether or not it was notified. The log is what the supervisory authority uses to verify that the decision not to notify was defensible.
Why it is like this
Without it, "we assessed it as low risk" is unverifiable, and the 72-hour duty would come down to self-assessment with no review.
Not to be confused with
A register of reported incidents. The entries that matter most under inspection are the ones you decided not to report, with the reasoning recorded at the time.
In practice
A mis-sent email to one wrong recipient, recalled within minutes: usually not notified, always logged, with the reasoning.
Source: Regulation (EU) 2016/679 (GDPR) — Article 33(5). Read on .
Say it back Check yourself
Which breaches must be documented internally, and what makes the log worth keeping?
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- All of them, notified or not
- Facts of the breach, its effects, and the remedial action taken
- It lets the authority verify the decision not to notify
- The reasoning is recorded at the time, not reconstructed later
The log's real audience is an inspector reading it two years later, asking why a given incident never reached them.