EDPB Issues New Guidance For Assessing Personal Data Breaches Under The EU GDPR

On Monday, 3 January 2022, the European Data Protection Board ("EDPB") published the finalized version of its regulatory guidance entitled "Examples regarding Personal Data Breach Notification"  (the "Guidelines"), following a public consultation on a draft set of guidelines in 2021. The finalized Guidelines are a practice-oriented, and case-based set of examples that leverage the experiences gained by EU Supervisory Authorities since the EU GDPR became applicable.

The Guidelines build on and complement the Guidelines on Personal data breach notification under Regulation 2016/679 published by the Article 29 Working Party (the "WP29" – the predecessor to the EDPB) in 2018 and subsequently endorsed by the EDPB. That document provides more general guidance on the EU GDPR's personal data breach provisions, including on the controller's obligations to: