Must we document data breaches that we decide not to report?

Yes. Article 33(5) of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). requires the controller to document every personal data breach, comprising the facts, its effects and the remedial action taken, whether or not it was notified to the supervisory authority. The point is to let the authority verify compliance later, including your decision that a breach was unlikely to result in a risk to people. So for each breach, record what happened, which data and people were affected, why you concluded that notification was or was not needed, who decided and when, and what you changed. Keep it in a breach register separate from, but linked to, your security incident log. Authorities can ask for it during an inspection or after a complaint, and a missing record of an unreported breach looks worse than the breach itself. NetSenX keeps the alert evidence behind each entry for the retention period of your plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics