Guides for handling a personal data breach under GDPR: the response plan, deciding whether to notify, ransomware, and notifying across several EU countries.
How to build a breach response plan around GDPR deadlines: when the clock starts, what the first notification must contain and what can follow in phases, processor duties, documenting every breach, and telling affected people.
How the GDPR treats a ransomware attack: availability and confidentiality breaches, how backups and encryption change notification outcomes in the EDPB's worked cases, and what regulators fined after recent attacks.
How to decide whether a breach must go to the authority, the affected people, both or neither: the unlikely-risk and high-risk thresholds, damage types to consider, the encryption exemption, documentation either way, and the proposed high-risk-only threshold.
Which supervisory authority to notify when a breach affects people in several Member States: the lead authority and one-stop-shop, the limits for companies without an EU establishment, bundled notifications, and parallel NIS2 reporting.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.