MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
You establish a data breach protocol by documenting in a single playbook: how employees recognize a data breach and report it internally, who assesses the severity, when to report to the Data Protection Authority (Art. 33 GDPR), when to inform data subjects (Art. 34 GDPR), and how to record each incident in the internal register (Art. 33, paragraph 5 GDPR). The protocol must be workable, especially under time pressure, as the 72-hour reporting period leaves little room for doubt regarding who does what.
The short answer
- Recognizing and reporting internally: how an employee identifies a leak and reports it immediately.
- Assessment: who weighs the risk and based on which criteria.
- Reporting to the DPA: when and how, within 72 hours (Art. 33 GDPR).
- Informing data subjects: in case of high risk, in clear language (Art. 34 GDPR).
- Documentation: record every breach in the register (Art. 33 para. 5 GDPR), even without notification.
Drafting a data breach protocol: the standard components
A usable protocol is not a theoretical document but a step-by-step plan that everyone can follow. The fixed components:
- Definition: what a data breach is, with recognizable examples such as a wrongly sent email or a lost data carrier.
- Reporting point: where an employee reports a suspected leak directly, with contact details and 24-hour availability.
- Assessment criteria: how you weigh the risk, focusing on the consequences for those involved.
- Decision tree: whether or not to report to the AP, whether or not to inform data subjects.
- Register: the format in which every incident is recorded.
- Evaluation: how you learn from the incident afterwards and tighten security.
Roles and responsibilities
Under time pressure, it must be clear who makes the decisions. Therefore, assign concrete roles. Who receives the internal reports, who assesses the severity, who decides on the report to the Data Protection Authority, and who drafts the communication to the data subjects? In a small company, this may be one or two people, but be sure to designate a replacement in case the first person is unavailable. A protocol that depends on a single absent employee fails at precisely the wrong moment.
Making the 72-hour clock workable
The 72-hour period under Art. 33 GDPR begins as soon as you are reasonably aware of the data breach. This is shorter than it seems, especially if a breach is discovered over the weekend. Therefore, build a rapid assessment into the protocol: an initial assessment within a few hours, followed by a decision. Include a provision that a notification to the DPA can be supplemented if necessary if not all information is yet available. This prevents you from letting the deadline expire because the investigation is still ongoing.
Elaborate concretely on the reporting threshold. Reporting is not required if it is unlikely that the breach poses a risk to the rights and freedoms of the data subjects. Provide examples relevant to your organization so that the assessor does not start from scratch every time.
Communication to stakeholders
If there is a high risk to the data subjects, you must inform them (Art. 34 GDPR). To do this, prepare a standard text that you can quickly adapt. This text describes in clear language what has happened, which data is involved, what the possible consequences are, and what measures they can take themselves, such as changing a password. A ready-made template saves valuable time at a moment when you don't have it.
A practical example: an online store discovers on Saturday that a database containing customer data was accessible. Thanks to the protocol, the person responsible is called immediately, the risk is assessed as high because passwords have been leaked, and a report is filed with the Dutch Data Protection Authority (AP) on Sunday with the standard text ready for customers. Without the protocol, Monday would have passed before anyone noticed the deadline.
Register and aftercare
Include the internal register as a standard step in the protocol. Document every data breach, even one you do not report, including the facts, the consequences, and the measures taken (Art. 33, para. 5 GDPR). Conclude with an evaluation: what went wrong, and which technical or organizational measure prevents recurrence. In this way, every incident also becomes an improvement to your security.
Honest recommendation
For a small business with limited and minimally sensitive personal data, you can easily draw up a workable protocol yourself using a good template. As long as you correctly incorporate the 72-hour clock, the notification threshold, and the registration requirement, and assign concrete roles, you do not need a lawyer.
Do have it reviewed when working with special personal data, multiple processors, or large data flows. In such cases, the assessment requires closer scrutiny, and you want to be certain that the notification chain and risk weighting are correct. In the event of a real incident, this setup determines whether you act on time and correctly, and an error in this regard is more expensive than having the protocol checked.
Also read the explanation regarding what a data breach protocol is and the costs of having a data breach protocol drawn up. You can have a document created via the data breach protocolpage.
Frequently Asked Questions
Document in a single protocol how employees recognize and report a breach, who assesses the severity, when to report to the Dutch Data Protection Authority and data subjects, and how to record each incident in the register. Assign specific roles and substitutes.
A clear definition of a data breach, an internal reporting point, assessment criteria, a reporting decision tree, the register format, and an evaluation step. Without these components, the protocol lacks the guidance needed under time pressure.
Incorporate a rapid initial assessment within a few hours and a decision well within 72 hours (Art. 33 GDPR). Include that a notification to the Data Protection Authority can be supplemented later if not all information is yet available.
Assign concrete roles: who receives the reports, who assesses the risk, who decides on the report, and who communicates with those involved. Always designate a substitute so that the protocol does not stall in the absence of one person.
Yes. You must record every data breach, even one you do not report, in an internal register containing the facts, consequences, and measures taken (Art. 33, paragraph 5 GDPR). The Dutch Data Protection Authority may request that register for verification purposes.
In the event of a high risk, inform the data subjects in clear language (Art. 34 GDPR): what has happened, which data is involved, and what they can do themselves. A prepared standard text saves time during a busy moment.
Refer to the agreement that processors notify you of a breach without undue delay (Art. 33, paragraph 2 GDPR), as set out in the processor agreement. This way, everyone knows who is warning whom, and you do not lose time in the notification chain.
