EDPB Publishes Supplementary Guidelines Regarding Data Breach Notification

The European Data Protection Board (“EDPB”) published a draft of supplementary guidelines for responding to, handling, and managing personal data breaches. The guideline is meant to add to the previous guideline on data breaches published by the EDPB's predecessor in October 2017. The new guidelines attempt to address practical issues related to managing data breaches.

The guidelines cover different representative types of data breaches, such as ransomware, accidental and intentional unauthorized disclosure of data, and loss of physical devices containing personal data. In each event, the controller must document the data breach, its effects, and the remedial action taken and consider whether notification of the data breach to the relevant supervisory authority and data subjects is necessary.