GDPR Articles 33 and 34: notifying the supervisory authority within 72 hours, processor notice to the controller, notification content and phasing, breach documentation, and communication to affected individuals.
When the 72-hour clock starts, the risk test that decides whether a breach is notifiable, which authority to notify, late notification with reasons, and the detection capability needed to become aware in time.
The processor's duty to tell the controller without undue delay after becoming aware of a breach, without first assessing risk, and how contracts set notice times and content so the controller can meet its 72 hours.
The minimum content of a notification to the supervisory authority, providing information in phases when facts are still emerging, and the forensic and log data needed to estimate scope and consequences.
The internal breach register: documenting every breach, notifiable or not, with facts, effects and remedial action so the supervisory authority can verify compliance, and how long to keep the records.
Telling affected individuals without undue delay when a breach is likely to result in a high risk: required content, the encryption and other exemptions, and supervisory authority orders to communicate.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.