On 18 January 2024, the European Data Protection Board
(EDPB) published a One-Stop-Shop case digest on Security
of Processing and Data Breach Notification (the Case
Digest). The Case Digest looks at a selection of decisions on
security of processing and personal data breach notifications taken
from the EDPB's public register. It is based on a review of 90
decisions made between January 2019 and June 2023, covering
Articles 32, 33, and 34 of the GDPR.
The Case Digest constitutes valuable guidance for organisations
when assessing the adequacy of their security measures, both prior
to and after a data breach. These decisions, issued through close
cooperation among data protection authorities
(DPAs), offer insights into how GDPR
provisions are applied in various scenarios, such as hacking or
accidental data disclosure. The Case Digest focusses on the
following three key categories of data breaches, offering practical
guidance for compliance:
