GDPR Breach 72h EN - personal data breach response (Art. 33-34)

Philosophy

In a breach, the clock and the documented reasoning are what matter. This skill runs a documented decision tree and produces drafts; the decision to notify and the act of sending belong to the controller/DPO. No guessing - missing inputs for the risk assessment are flagged as gaps, not filled.

Step 1 - Is it a breach, and which type

A breach is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Art. 4(12)). Classify: confidentiality (disclosure/access), integrity (alteration), availability (loss/destruction). Often combined.

Step 2 - Risk assessment to rights and freedoms