BizCortex documentation

Data breaches

Record, assess and report personal data breaches within 72 hours.

Under Art. 33 GDPR you must notify the supervisory authority within 72 hours of becoming aware of a breach. For a high risk, you must also inform the data subjects (Art. 34). Open "Data protection" and then "Data breaches". Counters show open breaches, pending notifications, missed deadlines and data subjects still to inform. The list shows number, title, "Aware since", the 72 hour deadline, risk and status.

Data breaches
Screenshot of this screen

Who can use this

  • Owner
  • Admin
  • Compliance

Steps

  1. 1. Record the breach at once

    Click "Record breach". The clock runs from the moment you became aware. Enter the title, what happened, when you became aware, who reported it, the categories of data and of data subjects and the approximate number of data subjects.

  2. 2. Assess

    Open the breach and click "Assess / edit". Describe the type of breach (Confidentiality, Integrity, Availability), the likely consequences, the measures taken and proposed, and the risk: Not assessed, No risk, Risk or High risk. The risk decides the notification duties while they are set to "Automatic (by risk)". You can also set them to Yes or No.

  3. 3. Notify the authority

    Click "Record notification". Enter when and to which supervisory authority you notified and their reference. After more than 72 hours, you must give the reasons for the delay. Click "Notification (PDF)" for a document with the details of Art. 33(3).

  4. 4. Inform the data subjects

    If required, use the draft "Communication to data subjects (draft)". It is a German template; review it and fill in the placeholders. Then click "Record communication" with the date and channel.

  5. 5. Close

    Click "Close". A closed incident cannot be changed afterwards.

Fields and options

Reasoning of the risk assessment

Required when you do not notify the authority (documentation per Art. 33(5)).

Exemption from the communication (Art. 34(3))

The documented reason why the data subjects are not informed.

Status

Open, Notified or Closed.

Clock

Shows the hours left, "overdue by" a number of hours, "notified", "notified late" or "not notifiable".

Good to know

  • The clock keeps running while the notification duty is undecided.
  • A breach can only be closed once the risk is decided and the owed notifications or the documented exemption are recorded.
  • Every change is written to the audit log.