From data-breach-response-skills
Assesses GDPR personal data breach risks for notification obligations under Articles 33/34 using CIA triad classification, sensitivity scoring, volume, identifiability, and EDPB guidelines.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin data-breach-response-skillsThis skill uses the workspace's default tool permissions.
When a personal data breach occurs, the controller must assess whether the breach is "likely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)) to determine whether supervisory authority notification is required, and whether it is "likely to result in a high risk" (Art. 34(1)) to determine whether data subject notification is required. This skill provides a structur...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
When a personal data breach occurs, the controller must assess whether the breach is "likely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)) to determine whether supervisory authority notification is required, and whether it is "likely to result in a high risk" (Art. 34(1)) to determine whether data subject notification is required. This skill provides a structured, repeatable methodology based on EDPB Guidelines 9/2022 and Guidelines 01/2021.
Every breach must first be classified according to the type of security compromise:
Unauthorized or accidental disclosure of, or access to, personal data.
| Scenario | Severity Indicator |
|---|---|
| Email containing 50 customer records sent to wrong internal department | Low — limited exposure, same organization |
| Database export of 200,000 records posted on public file-sharing service | Severe — mass exposure, publicly accessible |
| Employee accesses medical records of a colleague without authorization | Medium — limited scope but sensitive data |
| Backup tape containing unencrypted payroll data lost during transport | High — financial data, unknown accessor |
Unauthorized or accidental alteration of personal data.
| Scenario | Severity Indicator |
|---|---|
| Malware modifies patient medication dosages in a clinical database | Severe — potential physical harm |
| Software bug overwrites postal codes in 5,000 customer records | Low — non-sensitive field, reversible from backup |
| Unauthorized modification of employee performance review scores | Medium — potential employment consequences |
| SQL injection alters financial transaction records | High — financial integrity compromised |
Accidental or unauthorized loss of access to, or destruction of, personal data.
| Scenario | Severity Indicator |
|---|---|
| Ransomware encrypts the HR system for 48 hours; clean backup restored | Medium — temporary unavailability, data recovered |
| Fire destroys the only copy of archived patient records | Severe — permanent loss, healthcare impact |
| DDoS attack renders the customer portal unavailable for 6 hours | Low — temporary, no data loss or compromise |
| Cryptographic key destruction makes encrypted dataset permanently unreadable | Severe — irreversible data loss |
| Score | Criteria | Examples |
|---|---|---|
| 1 — Low | Non-sensitive data already in the public domain or easily obtainable | Business contact details, publicly listed addresses |
| 2 — Medium | Personal data that could cause minor inconvenience if disclosed | Email addresses, phone numbers, purchase history |
| 3 — High | Sensitive personal data or data with significant impact potential | Financial account details, government ID numbers, employment records |
| 4 — Severe | Special category data (Art. 9), criminal conviction data (Art. 10), or data enabling significant harm | Health records, biometric data, genetic data, sexual orientation, political opinions |
| Score | Data Subject Count | Rationale |
|---|---|---|
| 1 | Fewer than 100 | Limited scale — individual assessment feasible |
| 2 | 100 to 1,000 | Moderate scale — structured response required |
| 3 | 1,000 to 100,000 | Large scale — significant organizational impact |
| 4 | More than 100,000 | Mass scale — potential for widespread societal impact |
| Score | Criteria |
|---|---|
| 1 | Data is pseudonymized or encrypted; re-identification requires additional data held separately and securely |
| 2 | Data contains indirect identifiers only; re-identification possible with moderate effort |
| 3 | Data contains direct identifiers (name + one other element); individuals readily identifiable |
| 4 | Data contains multiple direct identifiers, photographs, or biometric data; immediate identification possible |
| Score | Potential Consequences |
|---|---|
| 1 | Minor inconvenience — e.g., receiving unsolicited marketing, needing to change a password |
| 2 | Moderate impact — e.g., targeted phishing risk, minor financial exposure, reputational inconvenience |
| 3 | Significant impact — e.g., identity theft risk, substantial financial loss, employment consequences, discrimination risk |
| 4 | Severe impact — e.g., physical safety threat, significant financial fraud, denial of essential services, threat to life |
| Score | Criteria |
|---|---|
| 1 | General adult population with no heightened vulnerability |
| 2 | Population includes some individuals in dependent relationships (employees, tenants) |
| 3 | Population includes elderly, financially vulnerable, or individuals in unequal power dynamics |
| 4 | Population includes minors, patients, asylum seekers, or individuals whose safety depends on data confidentiality |
| Score | Criteria |
|---|---|
| 1 | Controller processes personal data as an ancillary activity (e.g., office administration) |
| 2 | Controller processes personal data as a core activity for service delivery |
| 3 | Controller is in a position of trust (financial institution, healthcare provider, education) |
| 4 | Controller processes data at scale as a core business (data broker, payment processor, social media platform) |
| Aggregate Score | Risk Level | Art. 33 SA Notification | Art. 34 DS Notification | Required Action |
|---|---|---|---|---|
| 6-8 | Unlikely to result in risk | Not required | Not required | Document in Art. 33(5) breach register only |
| 9-12 | Risk present but below high threshold | Required within 72 hours | Not required | Notify supervisory authority; document fully |
| 13-18 | Likely to result in risk, approaching high | Required within 72 hours | Recommended | Notify SA; strongly consider DS notification |
| 19-24 | Likely to result in high risk | Required within 72 hours | Required without undue delay | Notify both SA and data subjects |
Every breach risk assessment must be documented with the following elements: