Articles 33 and 34 of the GDPR govern the handling of personal data breaches. Controllers must notify data breaches to the supervisory authority without undue delay and, where feasible, not later than 72 hours, unless the breach is unlikely to result in a risk to data subjects. In the case of a high risk, the data subjects must also be notified.

In the event of a data breach, a swift and structured approach is crucial to minimise risks.

As your external DPO, we provide preventive advice on developing internal processes and emergency plans for the proper handling of data protection incidents.

In the event of a specific incident, we support you in assessing the facts with regard to the risk to the data subjects and advise you on the resulting notification obligations. We guide you through the necessary notification procedures.