Every company that processes personal data must document personal data breaches, including incidents that do not need to be reported to UODO. A breach register is a mandatory document under Article 33(5) GDPR. If you do not keep one, you will not be able to demonstrate during an inspection that your organization responds properly to incidents. Below, you will find specific information on what to enter in the register, who must keep it and how to maintain it.
What is a personal data breach register?
A breach register is a document in which you record every personal data breach at your company. It does not matter whether the incident was serious or limited in scope: you record every one.
What is the breach register for?
- Recording breaches: you record every personal data breach, regardless of its scale or consequences.
- Managing risk: you analyze the causes of breaches and take preventive measures to reduce the risk of an incident recurring.
- Meeting a GDPR obligation: keeping the register follows directly from Article 33(5) GDPR. No register means no evidence of compliance.
- Documentation in case of an inspection: the register is the basic record you present to the President of UODO if an inspection takes place.
- Transparency of actions: you show that your organization manages incidents responsibly and protects data security.
- Analyzing and improving processes: you identify weaknesses in your data-protection system and make improvements.
What does a personal data breach register contain?
The register should contain detailed information about every incident:
- Date of the breach: the date the incident occurred and the date it was detected.
- Description of the breach: what happened, for example, a data leak, unauthorized access or data loss.
- Categories of data affected by the breach: which data was affected, such as first names, surnames, addresses or financial data.
- People whose data is affected: the number and categories of people whose personal data was affected.
- Consequences of the breach: possible consequences for the people affected by the incident, such as a risk of identity theft or financial loss.
- Remedial measures taken after the breach: actions taken to limit the consequences and prevent future incidents.
- Notification to the supervisory authority: whether the breach was reported to UODO and, if so, the date and method of reporting.
- Notification to the people whose data is affected: if the breach creates a high risk to their rights and freedoms, you must inform them.
- Risk assessment: a description of the risk associated with the breach and its impact on data protection.
What should you do with the breach register day to day?
- Keep it up to date: enter every new breach promptly after it is detected.
- Document your response: record the remedial measures taken and corrective procedures.
- Analyze the causes: check what led to the breach and how to prevent it in the future.
- Keep it in accordance with the rules: the register must be secured while remaining available to the supervisory authority.
- Provide it to supervisory authorities: during an inspection, the register is evidence that your organization responds properly to breaches.
- Take preventive action: use the information collected to strengthen personal data protection.
- Inform affected people: if the breach creates a high risk, notify the people affected about the steps taken.
Who must keep a breach register?
The obligation covers two groups:
- Data controller: your company, if it independently determines the purposes and means of processing personal data.
- Processor: a company that processes data on the controller’s instructions, such as an external IT provider or accounting firm.
The size of the organization does not matter. If you process personal data, you keep a register.
How AI can support breach-register management
Artificial intelligence tools can improve four areas:
- Automatic breach detection: AI monitors IT systems and identifies potential breaches, such as unauthorized access or information leaks.
- Risk analysis: algorithms assess the risk associated with each breach and identify which incidents require immediate notification to the supervisory authority.
- Automatic report generation: AI creates detailed breach reports, making it easier to document incidents and prepare notifications to UODO.
- Monitoring remedial actions: AI tracks the progress of remedial actions after a breach and checks whether the protective measures taken are sufficient.
Summary: what to implement first
A personal data breach register is a mandatory document required by the GDPR. Keeping it properly helps your company respond to breaches faster, reduce risk and demonstrate compliance during an inspection. Automation, including AI, speeds up incident detection and risk analysis.
If your company needs help creating and maintaining a personal data breach register, get in touch with our law firm. We offer audits, documentation and advice on personal data protection.
Q&A: how to document and report personal data breaches
1. What should you do after detecting a personal data breach?
Document the breach in the breach register immediately. Then assess the risk. If the breach may create a risk to people’s rights and freedoms, report the incident to the supervisory authority (UODO) and inform the people whose data was affected.
2. Which breaches must be reported to the supervisory authority?
Breaches that may create a risk to the rights and freedoms of the people whose data is concerned, for example, a leak of sensitive data such as health data, financial data or PESEL numbers.
3. How long should you keep the breach register?
At least 5 years, in accordance with GDPR requirements.
4. Where should you keep the personal data breach register?
In a central document repository, a personal data protection management system or as a paper record in the data protection department. Important: restrict and secure access.
5. How should access to the breach register be provided?
Only to authorized people, through a secure IT system with access controls or as a paper record kept in an appropriately secure place.
