New: a ready-to-use data breach response checklist.New: data breach response checklist.Download the checklist
EN
ContactEarly access
Early accessContact
Free tool

Data breach: do I need to notify?

Answer a few questions about the incident to see how serious it is on the European Data Protection Board (EDPB) and ENISA criteria, what you need to do, when your 72 hours run out and which authority to contact in your country. At the end you get a draft breach notification you can adapt.

Runs only in your browser: nothing you type is sent or storedGDPR Arts. 33 and 34Guidelines 9/2022 and 01/2021
1The clock

The moment you were reasonably certain that an incident involving personal data had happened (Guidelines 9/2022, point 31).

This decides which authority you notify.

Your organisation is…
2What data was affected

Tick every category involved and pick the description that fits each one best. The highest score is the one that counts (ENISA, section 3.1.1). The score can go up or down depending on how much data there is, the type of organisation, whether vulnerable people are involved, whether the data is invalid or already public, and what the data actually says.

3How easy is it to tell whose data it is?

Tick the identifiers that were in the data. The one that identifies people most easily counts (ENISA, annex 2).

ENISA says that combining identifiers makes people easier to identify. If the combination points to a specific person without any further searching, count it as maximum.

4What happened to the data
Did anyone act on purpose (theft, attack, fraud)?
5Safeguards and action taken
Was the data unintelligible (strong encryption, key not compromised)?

ENISA flags this separately from the score (section 3.3). Where strong encryption was used and neither integrity nor availability was lost, the EDPB found that recording the breach was enough (case 10 of Guidelines 01/2021).

If the risk is high, does one of the exceptions to telling the people affected apply?
Details for the draft (optional)

Draft breach notification


  

  
The scoring follows ENISA's 2013 recommendations, a working document the EDPB describes as useful (Guidelines 9/2022, point 120). Matching ENISA severity to the GDPR levels is Pulsaiq's own work; neither the EDPB nor any authority sets it. The tool helps you justify your decision, but the decision is still yours. If you're torn between two levels, pick the stricter one (Guidelines 9/2022, point 119). Always record the decision and your reasons (Art. 33(5)).


  
Want to keep this in your breach register? The breach response kit has a register that uses the same scoring, plus the 72-hour plan and notice templates.
See the kit


Choose what this site may store in your browser. You can change your mind at any time, here in the footer.
Strictly necessaryOnly store the choice you make in this panel. Always on.
Always on
Third-party contentEmbedded videos and maps. When they load, those services receive your IP address and may set their own cookies.
We don't use analytics or advertising cookies. Statistics are collected with Umami, without cookies. Read the cookie policy
Most searched
Most read guides
Your record of processing activities in an afternoonData breach: the first 72 hoursAccess and erasure requests
↑↓ choose Enter open Esc closeSearch runs in your browser. What you type isn't sent anywhere.