[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F34":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","34","Article 34","Communication of a personal data breach to the data subject",82,"General Data Protection Regulation","**What it asks for.** When a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform them without undue delay, in clear and plain language. Communication is not required in certain cases, for example where the data were rendered unintelligible by encryption, subsequent measures mean the high risk is no longer likely, or individual contact would involve disproportionate effort, in which case a public communication is used.\n\n**In practice.** Organisations include individual notification in their breach procedure, with criteria for assessing high risk and templates that explain what happened, likely consequences, measures taken and practical advice. Evidence includes the risk assessment, the decision, copies of communications and any instruction from the supervisory authority.\n\n**Common gaps.** Notifications are often delayed while facts are confirmed, or written in vague language that does not help people protect themselves. Reliance on encryption is claimed without checking that keys were not compromised.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_34","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"tfg-london-cyberattack-hits-multiple-retail-brands-across-shared-it-infrastructure","TFG London Cyberattack Hits Multiple Retail Brands Across Shared IT Infrastructure","2026-10-13T18:21:02.732+00:00",{"slug":23,"title":24,"published_at":25},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","2026-10-12T14:20:50.134+00:00",{"slug":27,"title":28,"published_at":29},"advantest-ransomware-attack-exposes-sensitive-personal-data-months-later","Advantest Ransomware Attack Exposes Sensitive Personal Data Months Later","2026-10-07T14:21:11.519+00:00",{"slug":31,"title":32,"published_at":33},"asos-app-hijacked-to-deliver-phishing-notifications-disguised-as-snowflake-breach-alert","ASOS App Hijacked to Deliver Phishing Notifications Disguised as Snowflake Breach Alert","2026-10-06T22:20:24.428+00:00",{"slug":35,"title":36,"published_at":37},"killsec-extortion-group-dismantled-in-10-country-operation","KillSec Extortion Group Dismantled in 10-Country Operation","2026-10-01T20:20:32.296+00:00",{"slug":39,"title":40,"published_at":41},"ransomware-hits-japanese-railway-giant-keio-disrupts-hospitality-payment-systems","Ransomware Hits Japanese Railway Giant Keio, Disrupts Hospitality Payment Systems","2026-09-28T22:20:40.912+00:00",{"slug":43,"title":44,"published_at":45},"shinyhunters-suspect-arrested-lessons-in-attribution-and-threat-actor-tracking","ShinyHunters Suspect Arrested: Lessons in Attribution and Threat Actor Tracking","2026-09-28T20:20:18.941+00:00",{"slug":47,"title":48,"published_at":49},"rogue-ai-agents-breach-sandbox-controls-and-compromise-government-systems","Rogue AI Agents Breach Sandbox Controls and Compromise Government Systems","2026-09-28T19:22:26.15+00:00",{"slug":51,"title":52,"published_at":53},"ai-agent-silently-breaches-australias-medicare-portal-for-three-months","AI Agent Silently Breaches Australia's Medicare Portal for Three Months","2026-09-24T19:21:59.421+00:00",{"slug":55,"title":56,"published_at":57},"ai-agent-breaches-australian-health-portal-government-left-in-the-dark-for-months","AI Agent Breaches Australian Health Portal — Government Left in the Dark for Months","2026-09-24T12:20:55.49+00:00",{"slug":59,"title":60,"published_at":61},"slovenian-institution-fails-to-identify-breach-victims-or-honor-access-rights","Slovenian Institution Fails to Identify Breach Victims or Honor Access Rights","2026-09-23T08:22:01.404+00:00",{"slug":63,"title":64,"published_at":65},"clop-ransomware-infrastructure-breached-by-shinyhunters-exposing-victim-data","Clop Ransomware Infrastructure Breached by ShinyHunters, Exposing Victim Data","2026-09-21T22:20:54.435+00:00",[67,72,76,80,85,90],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",20,{"slug":73,"name":74,"problem":75,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":77,"name":78,"problem":79,"stories":71},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":81,"name":82,"problem":83,"stories":84},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",15,{"slug":86,"name":87,"problem":88,"stories":89},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",14,{"slug":91,"name":92,"problem":93,"stories":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",12,[96,101,107,112,117,122,126,131],{"family":5,"item":97,"code":98,"title":99,"together":100},"33","Article 33","Notification of a personal data breach to the supervisory authority",75,{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","3","Control 3","Data Protection",47,{"family":5,"item":108,"code":109,"title":110,"together":111},"32","Article 32","Security of processing",36,{"family":102,"item":113,"code":114,"title":115,"together":116},"17","Control 17","Incident Response Management",32,{"family":102,"item":118,"code":119,"title":120,"together":121},"6","Control 6","Access Control Management",30,{"family":102,"item":123,"code":124,"title":125,"together":121},"13","Control 13","Network Monitoring and Defense",{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",28,{"family":132,"item":133,"code":134,"title":135,"together":130},"nist-800-53","ir-6","IR-6","Incident Reporting"]