A data breach starts a 72-hour clock. Be ready.

What the rules ask

• Who: every organisation that controls personal data under the GDPR.
• 72 hours: notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk.
• High risk: tell the people affected without undue delay.
• Every breach: document all breaches, also the ones you do not notify.

What is inside

1. Record a breach

   Type, data, number of people, risk level, what happened and what you did.

2. 72-hour clock

   Deadline and overdue warning, and a reminder to give reasons if you are late.

3. Notification

   A draft with the content Article 33 asks for.

4. Message to people

   A plain message for the people affected when the risk is high.

5. Breach log

   Export the full log as HTML or JSON for the authority or your auditor.

Why offline

A breach log is itself sensitive. This kit runs in your browser, with no server, account or upload.

Who it is for

• Small and medium businesses without a privacy team
• Data protection officers and privacy consultants
• Agencies and IT providers who handle data for clients

Guides

• GDPR breach register template: what Article 33(5) asks you to record, with a copyable template.
• 72-hour breach notification: when the clock starts and what to report.
• When to notify individuals: the Article 34 high-risk test and a message template.
• Spreadsheet vs tool vs consultant: an honest comparison of cost, time and risk.

Questions