Help us improve
Share bugs, ideas, or general feedback.
From data-breach-response-skills
Executes GDPR Article 33 personal data breach notifications to supervisory authorities within 72 hours, covering risk assessment, deadline calculation with holidays/weekends, required content, and DPO involvement.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin data-breach-response-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/data-breach-response-skills:breach-72h-notificationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Article 33 of the GDPR requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This skill provides the complete operational workflow from breach discovery through supervisory authority notification, including deadline calculation that accounts for weekends and public...
Executes GDPR Article 33 personal data breach notifications to supervisory authorities within 72 hours, covering risk assessment, deadline calculation with holidays/weekends, required content, and DPO involvement.
Guides GDPR Article 34 notifications to data subjects for high-risk personal data breaches, covering risk thresholds, required content, exemptions, and letter templates.
Executes LGPD security incident response runbook (Art. 48 LGPD + Resolução CD/ANPD nº 15/2024): guides 3-day notification deadlines, ANPD/subject notification items, and 5-year record retention.
Share bugs, ideas, or general feedback.
Article 33 of the GDPR requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This skill provides the complete operational workflow from breach discovery through supervisory authority notification, including deadline calculation that accounts for weekends and public holidays, mandatory notification content, and the decision framework for determining whether notification is required.
The 72-hour clock starts when the controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Per EDPB Guidelines 9/2022, Section 2.3:
A controller must notify the supervisory authority unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)).
| Type | Description | Example |
|---|---|---|
| Confidentiality breach | Unauthorized or accidental disclosure of, or access to, personal data | Database exposed via misconfigured firewall revealing 12,000 customer records |
| Integrity breach | Unauthorized or accidental alteration of personal data | Malware modifying patient medication dosage records in clinical database |
| Availability breach | Accidental or unauthorized loss of access to, or destruction of, personal data | Ransomware encrypting the HR payroll system containing 3,400 employee records |
Evaluate each factor on a scale of 1 (low) to 4 (severe):
| Factor | Assessment Question |
|---|---|
| Data sensitivity | Does the breach involve special categories (Art. 9), financial data, or government identifiers? |
| Volume | How many data subjects are affected? Under 100 / 100-1,000 / 1,000-100,000 / Over 100,000? |
| Identifiability | Can the breached data be used to directly identify individuals without significant effort? |
| Consequences | What concrete harm could result? Financial loss, discrimination, identity theft, reputational damage? |
| Vulnerable subjects | Are minors, patients, employees, or other vulnerable categories involved? |
| Controller-specific factors | Does the controller's role amplify risk (e.g., healthcare provider, financial institution)? |
The notification to the supervisory authority must contain, at minimum:
Art. 33(4) permits information to be provided in phases where it is not possible to provide all details simultaneously. The initial notification must:
| Authority | Jurisdiction | Notification Method |
|---|---|---|
| BfDI | Germany (federal) | Online portal at bfdi.bund.de — electronic form submission |
| CNIL | France | Online notification via notifications.cnil.fr/notifications |
| ICO | United Kingdom | Online form at ico.org.uk/for-organisations/report-a-breach |
| DPC | Ireland | Online breach notification form via forms.dataprotection.ie |
| AEPD | Spain | Electronic submission via sedeagpd.gob.es |
| Garante | Italy | PEC (certified email) to protocollo@pec.gpdp.it |
| AP | Netherlands | Online form at autoriteitpersoonsgegevens.nl/meldplicht-datalekken |
When notification exceeds 72 hours, Art. 33(1) requires the controller to accompany the notification with reasons for the delay. Acceptable justifications per EDPB guidance include:
Unacceptable justifications: