Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

What it covers

This document sets out eighteen practical case studies of personal data breaches, covering ransomware, data exfiltration, internal human risk sources, lost or stolen devices and mispostal, and social engineering. For each case it discusses the prior organisational and technical measures relevant to risk, and how controllers should assess whether notification to the supervisory authority and communication to data subjects under Articles 33 and 34 GDPR are required.

Why it matters

It supplements the general WP250 breach guidance with concrete, scenario-based analysis that controllers and DPOs can use to benchmark their own incident response and notification decisions.

Refer to it when

• assessing whether a specific type of incident triggers Article 33/34 notification
• benchmarking incident response against comparable scenarios
• training staff on breach recognition and categorisation
• evaluating prior security measures against documented case examples

Questions this document addresses

• When does a ransomware attack require notification to the supervisory authority?
• How should exfiltration of data from a website be risk-assessed?
• What prior measures reduce the impact of lost or stolen devices?
• When must data subjects be informed of a breach caused by mispostal or social engineering?

Topics

• Personal data breaches
• Security of processing
• Supervisory authorities