GDPR_BREACH_NOTIFICATION_001

rules/regulations/eu/gdpr_breach_notification.yaml

Citation

Regulation (EU) 2016/679, Article 33(1): In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

Condition

Requires controllers to notify the supervisory authority of a personal data breach without undue delay and not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. GDPR Article 33.

Layer 1 detects

data breach not reported, notified or disclosed; fail, failing or failure to notify, report or disclose a breach or data breach; breach notification not sent, required or made; delay, delaying or delayed breach notification; conceal, hide or cover up, in any form, followed by a breach or data breach, with no "the" between; "72 hours" or "three days" (also singular) followed by breach or notification deadline or requirement not met; no breach or incident notification or reporting process, procedure or plan; and personal data breach without or lacking notification or reporting. It matches wording, not meaning: it misses the practice told in other words ("We found the leak on Monday; keep it quiet and do not tell the regulator."), it does not read the Article 33(1) exception for a breach unlikely to result in a risk, so it fires on a lawful decision in these words ("Breach notification not required: the lost laptop was encrypted, so the breach is unlikely to result in a risk."), and it fires on text that only names the practice. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved