GDPR: ROPA, DPIA and 72-Hour Breach Notification

Article 33 requires the controller to notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. The processor must alert the controller without undue delay.

Article 35 requires one where a processing operation is likely to result in a high risk to the rights and freedoms of individuals, in particular in cases of systematic evaluation based on automated processing, large-scale processing of special categories of data, or systematic large-scale monitoring of a publicly accessible area.

Yes. Article 28 prohibits a processor from engaging a sub-processor without the written authorisation of the controller, and requires it to flow the same contractual obligations down. The initial processor remains fully liable for their performance.

Article 83 sets two caps: EUR 10 million or 2% of total worldwide annual turnover for breaches of controller and processor obligations, and EUR 20 million or 4% for breaches of the principles and of data subject rights, whichever is higher.

Yes. The severity wizard guides the qualification of a breach and triggers the 72-hour notification tracker to the supervisory authority, linking the breach to the processing, the processor involved and the evidence collected.