Breach Notification (Art. 33/34) — LegalAIPay GDPR Kit

Step 1 — Incident facts

Reference

Owner

Status

Detected at

Aware of breach at (start of 72h clock)

Controller

Processor (if any)

Description of incident Root cause (preliminary)

Approx. number of data subjects

Approx. number of records

Categories of data subjects Categories of personal data affected

Art. 9 special categories (health, ethnicity, religion, biometrics, …)

Children's data

Financial / payment data

Authentication credentials / passwords

Government IDs / passport / SSN

Precise location data

Private communications

Profile data enabling identification

Data Processing Context (DPC) — nature/sensitivity Ease of Identification (EI)

Circumstances of Breach (CB) Malicious intent?

Severity = DPC × EI + CB + MI. Thresholds: <2 Low · 2–3 Medium · 3–4 High · ≥4 Critical.

Actions taken to contain / mitigate Likely consequences for data subjects

Lead Supervisory Authority

Other SAs concerned

SA notification status (Art. 33)

Subject notification status (Art. 34)

DPO contact

Helpline / dedicated channel