Agent WranglersBreaches and reporting Required
Log every breach with its decision
Record every personal data breach in a register, including the ones you did not report. Give the facts, the effects, the actions and each decision's reason.
How to do it
GDPR Article 33(5) requires this record, and the authority may ask to see it. Write one entry per breach as data. Include a lost laptop, an email sent to the wrong customer and a misconfigured bucket. Note the time of awareness, the people and records affected, the risk decision and its reason, and the times you reported. Keep the register apart from the incident chat, with the same protection as the audit log.
Example
- id: BR-2026-007
aware_at: 2026-10-20T09:00Z
what: Invoice email sent to the wrong customer
people: 1
records: 1
data: [name, address, order total]
risk: low
reported_to_authority: false
reason: One recipient, a business customer, confirmed deletion in writing within two hours.
people_told: false
actions: [check recipient against order before sending]How to check
A script fails when an incident tagged as a personal data breach has no register entry. It also fails when an entry lacks a decision after 72 hours.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-register.