EU GDPR—personal data breach notification—flowchart

Copyright © 2025 LexisNexis
Published by a LexisNexis EU Law expert
Flowcharts

EU GDPR—personal data breach notification—flowchart

Copyright © 2025 LexisNexis

Published by a LexisNexis EU Law expert

Flowcharts
imgtext

The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) is directly applicable and fully enforceable in EU and EEA states. This Flowchart focuses on personal data breach notification under the EU GDPR.

It covers:

  1. •

    a summary of the overarching obligations

  2. •

    key guidance

  3. •

    types of personal data breaches

  4. •

    the flowchart of notification requirements

  5. •

    general examples of personal data breaches and who to notify

  6. •

    detailed examples of personal data breaches and who to notify

The EU GDPR includes the following definition of a personal data breach:

‘…a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.’

Overarching obligations

In summary, among other things, the EU GDPR provides that:

  1. •

    data processors must notify the data controller without undue delay after becoming aware of a personal data breach

  2. •

    unless the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals, the data controller must notify the appropriate supervisory

Powered by Lexis+®
Jurisdiction(s):
European Union

Popular documents

What is the difference between an appeal and a review?

What is the difference between an appeal and a review?What is an appeal?An appeal in insolvency proceedings is no different to an appeal in normal litigation. An appeal will be allowed only if the appeal court is satisfied that the decision of the lower court was 'wrong' or 'unjust because of a

If a rentcharge is shown as being informally exonerated on title information, does this apply to the

If a rentcharge is shown as being informally exonerated on title information, does this apply to the current registered owner? Or does the informal exoneration only apply to the parties to the document which informally exonerated the rentcharge?This Q&A considers the situation where, at some

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal

If a beneficiary signs a deed of disclaimer of their share of an estate and the estate pays their legal fees, will that count as a PET against their estate?A disclaimer is the refusal of a gift prior to acceptance. The refusal of the gift must take place before the beneficiary accepts any benefit

Can shares in a limited company that have not been paid-up at all be cancelled?

Can shares in a limited company that have not been paid-up at all be cancelled?A limited company having a share capital may not alter that share capital, except in the ways listed in section 617 of the Companies Act 2006 (CA 2006). Shares in a company cannot simply be cancelled without following an