gdpr-breach-72h-en

name	gdpr-breach-72h-en
description	Personal data breach response assistant grounded in GDPR Art. 33-34, EDPB Guidelines 9/2022 on breach notification, and national supervisory-authority breach forms. Runs the decision tree: (1) is it a breach and which type (confidentiality/integrity/availability), (2) risk assessment to rights and freedoms, (3) notify the SA within 72h (Art. 33) - with a deadline counter from awareness, (4) communicate to data subjects (Art. 34, "high risk") + exemptions, (5) internal breach register entry (Art. 33(5)). Drafts the notification and communications - it does NOT send to the SA or to data subjects (human acts). Adds no connectors and makes no outbound calls of its own; the incident details you paste still go to the model you have configured. Use when: "data leak", "GDPR breach", "72-hour notification", "do we notify individuals", "Art. 33", "breach response".
license	Apache-2.0
allowed-tools	["Bash","Read"]
data-residency	local
requires-human-approval	true
pii-egress	none
metadata	{"author":"Wiesław Mazur / MateMatic","version":"1.1.0","companion_skills":"gdpr-dpia-en, legal-ai-audit-bundle","parity":"rodo-naruszenie-72h-pl"}

GDPR Breach 72h EN - personal data breach response (Art. 33-34)

Philosophy

In a breach, the clock and the documented reasoning are what matter. This skill runs a documented decision tree and produces drafts; the decision to notify and the act of sending belong to the controller/DPO. No guessing - missing inputs for the risk assessment are flagged as gaps, not filled.

Step 1 - Is it a breach, and which type

A breach is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Art. 4(12)). Classify: confidentiality (disclosure/access), integrity (alteration), availability (loss/destruction). Often combined.

Step 2 - Risk assessment to rights and freedoms

Factors (EDPB 9/2022, formerly WP250): type of breach, nature/sensitivity/volume of data, ease of identification, severity of consequences (identity theft, financial loss, discrimination, reputational harm), special characteristics of individuals (children, patients), number of individuals affected. Output: risk: none / present / high.

Step 3 - Notify the SA (Art. 33) - 72h COUNTER

• The clock starts on AWARENESS of the breach (not the event). Deadline: 72 hours.
• Notify unless the breach is unlikely to result in a risk to rights and freedoms (Art. 33(1)). No notification => justify and document.
• After the deadline => notify with reasons for the delay (Art. 33(1) sentence 2).
• Notification content (Art. 33(3)): nature of the breach (categories and approximate numbers of data subjects and records), DPO contact, likely consequences, measures taken/proposed. Phased notification is allowed (Art. 33(4)).
• The skill computes deadline_72h (date+time) and drafts to the SA form's fields.

Step 4 - Communicate to data subjects (Art. 34)

If high risk => communicate to individuals without undue delay, in clear and plain language (Art. 34(2): description, DPO, consequences, measures). Exemptions (Art. 34(3)): appropriate safeguards (e.g. encryption rendering data unintelligible), subsequent measures eliminating the high risk, or disproportionate effort => public communication instead.

Step 5 - Breach register (Art. 33(5))

Record EVERY breach (even unreported ones) in the internal register: facts, effects, remedial action. This is the accountability evidence for the SA.

Tool - deadline calculator (deterministic, offline)