Maintaining Breach Documentation Records

Overview

Article 33(5) of the GDPR requires every controller to document all personal data breaches, regardless of whether the breach triggered supervisory authority notification. The documentation must include "the facts relating to the personal data breach, its effects and the remedial action taken" and must "enable the supervisory authority to verify compliance with this Article." This creates a comprehensive breach register that serves as a primary accountability document under Art. 5(2).

Mandatory Documentation Requirements — Art. 33(5)

Facts Relating to the Breach

Every breach register entry must document: