Overview

This article requires controllers to notify data subjects without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms. Notifications must be clear, concise, and easily understandable, detailing the nature of the breach, contact information, potential consequences, and mitigation measures. Notification may be exempted if encryption or other protective measures eliminate the risk, or if notification would be disproportionate.

Key Principles

  • Timely Communication: Inform affected individuals as soon as possible following breach detection.

  • Clarity and Transparency: Provide understandable details on the breach, its consequences, and mitigation steps.

  • Risk-Based Approach: Notification is required only when the breach poses a high risk to rights and freedoms.

  • Exemptions: No notification is needed if protective measures (e.g., encryption) reduce risk or notification would be disproportionate.

Organizational Applicability

This article applies to all organizations processing personal data within the EU:

  • Controllers managing personal data of EU/EEA data subjects.

  • Public and private sector entities responsible for data security and breach management.

  • Teams handling incident response, compliance, IT security, and communications to affected individuals.

Implementation Requirements

  • Establish procedures for assessing breach severity and determining if notification is required.

  • Notify data subjects promptly if the breach poses high risk.

  • Include information on the nature of the breach, potential consequences, mitigation measures, and contact details.

  • Document decisions and actions taken regarding notification, including exemptions.

Implementation Guidance

  • Use templates or standard formats for breach notifications to ensure clarity and consistency.

  • Train staff on evaluating risk levels and communicating effectively with data subjects.

  • Coordinate with supervisory authorities when needed.

  • Periodically review breach communication procedures for compliance and efficiency.

Periodic Review

  • Frequency: Annually or after significant breaches or updates to processing systems.

  • Responsible Role: Data Protection Officer (DPO), Compliance Team, or IT Security.

  • Outcome: Ensure timely, clear, and risk-appropriate notification to data subjects.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Enforcement actions for failing to notify or improperly notifying data subjects.

  • Reputational Damage: Loss of trust due to delayed or unclear communication.

  • Operational Risk: Mishandling breach communications may exacerbate harm and regulatory scrutiny.