[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F33":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",522,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** When a personal data breach occurs, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Processors must inform the controller without undue delay. All breaches must be documented, whether or not they are notified.\n\n**In practice.** Organisations have a breach procedure that links security incident response to data protection assessment, with clear roles for deciding whether notification is required. The notification describes the nature of the breach, likely consequences, measures taken and a contact point, and can be provided in phases. Evidence includes an internal breach register, decision records and processor contracts that require prompt reporting.\n\n**Common gaps.** The clock is often misunderstood or started late because security and privacy teams work separately. Breaches judged not notifiable are frequently left undocumented.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_33","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":23,"title":24,"published_at":25},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":27,"title":28,"published_at":29},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":31,"title":32,"published_at":33},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":35,"title":36,"published_at":37},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":39,"title":40,"published_at":41},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":43,"title":44,"published_at":45},"international-csam-crackdown-highlights-platform-accountability-and-reporting-gaps","International CSAM Crackdown Highlights Platform Accountability and Reporting Gaps","2026-10-15T12:20:23.726+00:00",{"slug":47,"title":48,"published_at":49},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":51,"title":52,"published_at":53},"centerpoint-energy-breach-exposes-1m-texans-pii-via-cybercrime-forum-disclosure","CenterPoint Energy Breach Exposes 1M+ Texans' PII via Cybercrime Forum Disclosure","2026-10-15T10:20:22.506+00:00",{"slug":55,"title":56,"published_at":57},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",{"slug":59,"title":60,"published_at":61},"billion-message-phishing-campaign-disrupted-by-microsoft-coalition","Billion-Message Phishing Campaign Disrupted by Microsoft Coalition","2026-10-14T20:21:09.517+00:00",{"slug":63,"title":64,"published_at":65},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",125,{"slug":73,"name":74,"problem":75,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",114,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",107,{"slug":83,"name":84,"problem":85,"stories":86},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",106,{"slug":88,"name":89,"problem":90,"stories":91},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",101,{"slug":93,"name":94,"problem":95,"stories":96},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",73,[98,103,109,114,118,124,129,134],{"family":5,"item":99,"code":100,"title":101,"together":102},"32","Article 32","Security of processing",371,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","3","Control 3","Data Protection",256,{"family":110,"item":111,"code":112,"title":112,"together":113},"itil","overview","ITIL",214,{"family":104,"item":115,"code":116,"title":117,"together":113},"6","Control 6","Access Control Management",{"family":119,"item":120,"code":121,"title":122,"together":123},"nist-800-53","ac-2","AC-2","Account Management",188,{"family":104,"item":125,"code":126,"title":127,"together":128},"13","Control 13","Network Monitoring and Defense",171,{"family":104,"item":130,"code":131,"title":132,"together":133},"17","Control 17","Incident Response Management",146,{"family":5,"item":135,"code":136,"title":137,"together":138},"5","Article 5(1)(f)","Principles relating to processing of personal data",122]