GDPR Security and Personal Data Breach Response

Article 32 control model

Security must be appropriate to risk, considering state of the art, implementation cost, processing context, and potential impact on people. Relevant measures include pseudonymization and encryption, ongoing confidentiality/integrity/availability/resilience, timely restoration, and regular testing of control effectiveness.

This is not a fixed checklist. The controller and processor must connect threats, data sensitivity, scale, access, dependency, recovery, and human impact to selected controls and evidence.

Breach decision workflow

1. Contain and preserve: limit exposure while retaining reliable evidence.
2. Establish awareness time: record when the controller had a reasonable degree of certainty that a personal-data breach occurred.
3. Characterize data and people: categories, approximate numbers, sensitivity, identifiability, protections, recipients, duration, and geography.
4. Assess consequences: identity theft, fraud, discrimination, confidentiality loss, physical or economic harm, loss of control, and other effects.
5. Decide supervisory notification: Article 33 requires notification without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to result in risk to rights and freedoms.
6. Decide communication to people: Article 34 applies where the breach is likely to result in high risk, subject to its conditions and exceptions.
7. Document regardless: record facts, effects, decisions, notifications, delays, containment, recovery, and corrective action.

Evidence pack

• incident timeline and awareness rationale;
• affected systems, data flows, people, and processors;
• risk and high-risk assessment criteria;
• notification decision and approval;
• regulator and data-subject communications;
• processor notices and contractual timing;
• containment, recovery, and control test results; and
• lessons learned, owners, deadlines, and effectiveness review.

Primary references

• GDPR Articles 32-34
• EDPB Guidelines on personal data breach notification