# Must we document data breaches that we decide not to report?

Yes. Article 33(5) of the GDPR requires the controller to document every personal data breach, comprising the facts, its effects and the remedial action taken, whether or not it was notified to the supervisory authority. The point is to let the authority verify compliance later, including your decision that a breach was unlikely to result in a risk to people. So for each breach, record what happened, which data and people were affected, why you concluded that notification was or was not needed, who decided and when, and what you changed. Keep it in a breach register separate from, but linked to, your security incident log. Authorities can ask for it during an inspection or after a complaint, and a missing record of an unreported breach looks worse than the breach itself. NetSenX keeps the alert evidence behind each entry for the retention period of your plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/must-we-document-data-breaches-we-do-not-report

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [When must we tell the affected people about a data breach?](https://netsenx.com/en/faq/when-must-we-tell-affected-people-about-a-data-breach)
- [When does the NIS2 24-hour clock start?](https://netsenx.com/en/faq/when-does-the-nis2-24-hour-clock-start)
- [What has to be in a NIS2 early warning?](https://netsenx.com/en/faq/what-has-to-be-in-a-nis2-early-warning)
- [Is the final report due one month after the incident?](https://netsenx.com/en/faq/is-the-final-report-due-one-month-after-the-incident)
- [Are the deadlines different for trust service providers?](https://netsenx.com/en/faq/are-the-deadlines-different-for-trust-service-providers)