Decide the risk with a fixed method

How to do it

Under Article 33, you report unless the breach is unlikely to result in a risk to people. Under Article 34, you tell the people affected when the risk is high. Use a public method, such as the ENISA breach severity method, and the EDPB examples in guidelines 01/2021. Score the kind of data, how easily people can be identified and the harm that could follow. Data encrypted with a key that did not leak usually scores low. Write the score that means report to the authority and the score that means high risk next to the method.

How to check

Every register entry has a method name, a score and a decision. A script fails when a score at or above the reporting threshold has reported_to_authority: false. It also fails when a score at or above the high-risk threshold has people_told: false.