Data Protection Coordinator Training: Incident Management & Reporting Obligations

Under Article 33 GDPR, a personal data breach must be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. An exception applies only if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Our training teaches you how to correctly perform this risk assessment and submit the notification on time.

Article 33 GDPR requires notification to the supervisory authority within 72 hours. Article 34 GDPR concerns notification to affected data subjects and only applies when the breach is likely to result in a high risk to their rights and freedoms. The training covers when each notification is required and what information must be included in each type of report.

A data breach notification is submitted via the online reporting portal of the competent supervisory authority. It must include at minimum: the nature of the breach, affected data categories and approximate number of individuals, contact details of the Data Protection Officer, a description of likely consequences and remedial measures taken. Our training includes practical exercises with actual notification forms.

Failure to comply with the notification obligation under Article 33 GDPR can result in fines of up to EUR 10 million or 2 percent of annual worldwide turnover, whichever is higher. Late or incomplete notifications can also lead to sanctions. The training shows how to meet deadlines and fulfil documentation requirements to minimise fine exposure.

A reportable breach occurs when personal data is unlawfully disclosed, altered, destroyed or accessed without authorisation, resulting in a risk to the rights and freedoms of individuals. Examples include: cyberattacks with data exfiltration, accidental email sent to wrong recipients, loss of unencrypted storage devices or ransomware attacks. The training teaches the criteria for conducting proper risk assessments.

A structured incident response process covers five phases: detection and initial assessment of the incident, containment and immediate measures, investigation and root cause analysis, notification to supervisory authority and data subjects, and post-incident review with lessons learned. The training walks through each step using real-world case studies and provides documentation templates.

Under Article 33(5) GDPR, all personal data breaches must be documented — including those that are not reportable. The documentation must include: the facts of the breach, its effects and remedial actions taken. This documentation must be available for inspection by the supervisory authority on request. The training provides templates and checklists for audit-proof documentation.