In a data breach, you essentially need three types of documents: an internal record of what happened, an assessment of whether notification to the Data Protection Authority is required, and — if it is — the notification itself with its supporting documentation. If notification to data subjects is also required, that communication also counts as a document to be retained.
The detail most often overlooked in this subject is the internal record. Even if, after assessment, you decide that a data breach does not need to be reported to the Data Protection Authority, the GDPR still requires you to document the incident itself: what happened, which data it affected, what the potential consequences were, and why you reached your conclusion. Many entrepreneurs think documentation is only necessary once a report is made. That is not what the regulation describes.
The internal record of the incident
This is the document that should exist for every data breach, regardless of the outcome of your assessment. It describes when you discovered the incident, what exactly occurred, which categories of data and which data subjects were affected, and what measures you took to limit the consequences. Supervisory authorities, when conducting inspections, do not only look at notifications that have been made, but also whether an organization can demonstrate how previous incidents were assessed. Without this document, that supporting evidence does not exist.
The assessment of whether notification is required
Alongside the factual record, a second document is needed: the assessment itself. What risks did you identify for the data subjects, and on what basis did you conclude that notification was or was not required? The GDPR distinguishes the risk to the rights and freedoms of data subjects as the criterion. Documenting that assessment is not only helpful for you later, it is also the document with which you can show that a conscious decision was made, not by chance. Anyone in doubt about whether a specific incident must be reported will find in the decision tree that provides an initial indication in a few questions a starting point, without replacing your own assessment.
The notification to the Data Protection Authority
If the conclusion is that notification is required, the notification itself becomes a document: what you reported, when, and with which information. The GDPR specifies a deadline of 72 hours from when you became aware of the data breach. Keep not only the confirmation of the notification, but also the version of the facts as they were known at the time of reporting — this may be supplemented later if more becomes clear about the scope.
Communication to data subjects
In some cases, there must also be a message to the data subjects themselves, for example when the risk to them is considered significant. That message — what was communicated exactly and to whom — is part of the file. It is not a fixed template that is the same for every data breach; the content depends on what happened and which data is involved.
Agreements with suppliers and processors
If the data breach occurs at a party that processes data for you, such as accounting software or a hosting provider, then the agreement documented in the processor agreement should also be included: does that party notify you of incidents, and within what timeframe? Anyone who has not clarified this yet will find in the knowledge base where this is worked out for each situation a starting point to review processor agreements on this point.
Why this file is separate from your security
The documentation around a data breach is different from the measures you put in place beforehand to prevent a data breach, but the two are related: a supervisory authority can ask what your security looked like at the time of the incident. How data security is recorded in practice can be read via the guidance on appropriate security measures.
Have this in order now
The knowledge base and the decision tree are free to consult, without an account. If you want the registration of incidents, the timelines and the templates for them to be structured in one place instead of having to search for them again each time, that is what the subscription at gdpria.eu is set up for. A business account is created in the name of your Chamber of Commerce and VAT number, linked to the organization and not to a single email address.
If you currently have a possible data breach to assess, first go through the free quick-scan or read through the topics in the knowledge base. For an explanation of what exactly applies to your situation, a legal professional or the Dutch Data Protection Authority remains the appropriate point of contact.