GDPR: EDPB's New Breach Guidelines Present Additional Challenges For Legal & Security Professionals

To close out 2021, the European Data Protection Board (EDPB) adopted additional General Data Protection Regulation (GDPR) data breach notification guidelines in Guidelines 01/2021 on Examples regarding Personal Data Breach Notification (Guidelines). The Guidelines supplement-and do not replace-the 2018 Article 29 Working Party guidance on breach notification. While the EDPB provides realistic examples and practical guidance for security incidents, the Guidelines oversimplify the complexities of breach notification analysis and what is required to get to a decision point. The Guidelines' simplistic approach may risk magnifying legal exposure for organizations that respond to a security incident without thorough technical and legal analysis informed by an intensive investigation.