| name | breach-documentation |
| title | Maintaining Breach Documentation Records |
| description | Maintains the GDPR Article 33(5) breach register documenting all personal data breaches regardless of whether supervisory authority notification was required. Covers mandatory register fields including facts, effects, and remedial actions, retention periods, audit readiness, and integration with the accountability framework. Keywords: breach register, Article 33(5), breach documentation, accountability, audit readiness, remedial actions. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/breach-documentation |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Maintaining Breach Documentation Records
Overview
Article 33(5) of the GDPR requires every controller to document all personal data breaches, regardless of whether the breach triggered supervisory authority notification. The documentation must include "the facts relating to the personal data breach, its effects and the remedial action taken" and must "enable the supervisory authority to verify compliance with this Article." This creates a comprehensive breach register that serves as a primary accountability document under Art. 5(2).
Mandatory Documentation Requirements — Art. 33(5)
Facts Relating to the Breach
Every breach register entry must document:
| Field | Description | Example |
|---|
| Breach reference number | Unique sequential identifier | SPG-BREACH-2026-003 |
| Discovery date and time | UTC timestamp when controller became aware | 13 March 2026, 14:30 UTC |
| Breach date and time | UTC timestamp of the breach itself (if different from discovery) | 13 March 2026, 11:15 UTC |
| Breach type | Confidentiality, integrity, availability, or combined | Availability (primary), Confidentiality (under investigation) |
| Breach description | Factual narrative of what occurred | LockBit 3.0 ransomware encrypted production customer database cluster. Attack vector: compromised service account obtained via spear-phishing. |
| Affected systems | Systems involved in the breach | db-prod-eu-west-01 through db-prod-eu-west-04 |
| Data subject categories | Types of individuals affected | Individual account holders, business account holders, joint account holders |
| Data subject count | Approximate number of affected individuals | 15,230 |
| Personal data categories | Types of data compromised | Names, postal addresses, emails, payment card last-4, transaction histories, account balances |
| Record count | Approximate number of affected records | 48,720 |
| Root cause | Identified cause of the breach | Stale privileged service account + phishing + push-fatigue MFA bypass |
| Containment timestamp | When the breach was contained | 13 March 2026, 12:45 UTC |
Effects of the Breach
