Art.34 Communication of a personal data breach to the data subject
Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate the breach to the affected data subjects without undue delay, describing in clear and plain langu
5
artefacts
1
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Timing records showing the interval between awareness of high risk and communication to individuals · HR system / LMS
periodic reviewEvidence produced at each review
- The high risk assessment per breach, kept distinct from the Article 33 assessment, which uses a lower threshold · Policy repository / GRC workspace
- Where the encryption exemption is relied on, evidence the measure covered the specific affected data and that the keys were not also compromised · Policy repository / GRC workspace
- Where disproportionate effort is claimed, the public communication actually made and evidence of the reach it achieved · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The communication as sent, assessed for clear and plain language and for the three content elements required · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your HR system / LMS on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Communication deferred until the investigation completes, when the Article requires it without undue delay once high risk is identified
- The encryption exemption claimed generally for an encrypted estate without showing it covered the data actually lost
- Notices written in legal or technical language, failing the clear and plain language requirement even where the timing was met
- Individuals told what happened but not the likely consequences or what to do, which is the part that lets them protect themselves
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.33 Notification of a personal data breach to the supervisory authority · Art.35 Data protection impact assessment