GDPR breach notification: the 72 hours

When a personal data breach may risk people’s rights, the controller tells the supervisory authority within 72 hours of becoming aware of it, and the people affected too when the risk is high. This page gives the rule from the legal text, then what Jira does by itself, then what Dueline does.

What the GDPR says

• To the authority (Article 33): the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people’s rights and freedoms. A notification made later comes with the reasons for the delay. The information may be given in phases.
• To the people (Article 34): when the breach is likely to result in a high risk, the controller also tells the people affected without undue delay, in clear and plain language.
• The register (Article 33(5)): every breach is documented, notified or not: the facts, its effects and the remedial action taken.

The text is Regulation (EU) 2016/679. A notification holds the nature of the breach, the categories and approximate number of people and records, the contact point, the likely consequences and the measures taken. Whether a breach must be notified is your assessment, and national law may add to it.

What Jira does by itself

Jira can hold the breach as a work item and a team can add a Due date. That field is a date without a time, so it cannot hold “72 hours from 14:10 on Friday”, and it does not know that the people affected need telling only when the risk is high, nor that the register is kept either way. Teams tend to keep the clock, the register and the authority’s reference in a separate sheet.

What Dueline does

Dueline is our app. On the work item, Qualify asks when you became aware and whether the breach may risk people’s rights, and whether the risk is high. It then lists the notification to the supervisory authority with its 72 hours, the communication to the people affected when the risk is high, and the breach register, which Dueline lists from what was recorded. Each report shows what the article asks it to hold and links the rule on EUR-Lex. You notify the authority yourself, then press Record as sent with the time and the authority’s reference. A notification past its 72 hours turns red and points to the reasons for the delay the rule asks for.

Dueline sends nothing, and the assessment is yours. Work the dates out first with the free deadline calculator. Step by step: Qualify a work item.

Other rules: DORA incident reporting and the NIS2 early warning. Back to Dueline.