Notification of a personal data breach to the supervisory authority
Art. 33
-
Last updated
Mandatory
Catalog reference
Notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Document the facts, effects, and remedial action taken, even for breaches you decide not to report.
Narrative — how we satisfy this requirement
A suspected breach goes to the Incident Coordinator, who decides with the Data Protection Officer on notifying the Dutch Data Protection Authority within 72 hours.
Code
Title
Status
No risks are linked to this requirement. Link from a risk's Edit page.