GDPR breaches
Controllers notify the supervisory authority of personal data breaches within 72 hours where feasible. We track each breach’s deadline, draft the notification and keep the breach register.
Breach notification and communication under Articles 33 and 34 GDPR, with a telecom profile
The duty
- Who reports
- Controllers under the GDPR
- Legal basis
- Articles 33 and 34 GDPR; § 169 TKG and Regulation (EU) No 611/2013 for telecom providers
- 72 hNotification to the supervisory authority, where feasible (Article 33)
- In phasesFurther information as it becomes available (Article 33(4))
- Every breachIn the breach register, notified or not (Article 33(5))
Counted from when you become aware. Telecom providers also notify the BNetzA and the BfDI within 24 hours of detection, where feasible.
Read the explainer: GDPR breach notificationWhat the Reporting Desk does
- The Article 33 clock: notification to the supervisory authority within 72 hours of becoming aware, where feasible, with a field for the reasons if notification is late.
- Drafts with the Article 33(3) information, which you can supplement in phases (Article 33(4)).
- Communication to data subjects (Article 34), with the Article 34(3) exceptions as a checklist.
- Register of all breaches, including those not notified (Article 33(5)).
- The reporting channel of the competent German supervisory authority: every federal state and the BfDI.
- Telecom profile under § 169 TKG and Regulation (EU) No 611/2013: notification to the BNetzA and the BfDI within 24 hours of detection where feasible, and a second notification within three days.
- Breach records hold the categories and approximate numbers of data subjects and personal data records concerned, not their identities.
- Alerts, backup escalation, audit trail, export and hosting in Germany, as in every module.
Plans
Starter €39, Team €99, Business €199 a month, for 1, 3 or 10 controllers. Yearly billing: 12 months for the price of 10.
For businesses only. All prices plus VAT.