Breaches and reporting

Required

• Start every reporting clock from one moment

  Required

  Record the moment you became aware of an incident, and compute every legal and contract deadline from it in code, the moment the incident opens.

• Log every breach with its decision

  Required

  Record every personal data breach in a register, including the ones you did not report. Give the facts, the effects, the actions and each decision's reason.

• Decide the risk with a fixed method

  Required

  Decide whether a breach must be reported with one written scoring method, and store the score next to the decision.

• Keep the notices ready

  Required

  Keep notices ready for the authority, business customers and the people affected, with every field the law asks for. Know where to file each one.

• Tell your customers when you are their processor

  Required

  When you process data for business customers, tell each affected customer about a breach without undue delay and within the hours your agreement promises.