What counts as a "personal data breach"
GDPR defines a breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed". It is broader than most engineers expect: a deleted database table, an admin who shoulder-surfs a screen, a misdirected email — all qualify.
72 hours from awareness
The clock starts when you have a reasonable degree of certainty that a breach has occurred — not when investigation ends. If you cannot provide all information within 72 hours, file an initial notification and supplement it.
Who you must notify
- The competent Supervisory Authority — typically your lead SA under the one-stop-shop, plus any SAs of materially affected member states.
- Affected individuals — "without undue delay" if the breach is likely to result in a high risk to their rights and freedoms. Three exceptions apply (technical measures rendering data unintelligible, subsequent measures eliminating risk, disproportionate effort).
- Your customers, if you are acting as a Processor — see your DPA for the contractually agreed window (often 24–48h).
What goes in the notification
- Nature of the breach: categories & approximate numbers of data subjects and records.
- Contact point (DPO or representative).
- Likely consequences.
- Measures taken or proposed to address it and mitigate effects.
The iCompaas breach workflow
The Privacy module includes a Breach Notification playbook that walks responders through the GDPR-required fields, generates a draft Supervisory Authority report (per-country format), keeps an audit trail of who decided what when, and produces an individual notification template that legal can sign off.