CLAIM-2026-09-28-10

GDPR Article 33(5) requires the controller to document any personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken, and provides that the documentation shall enable the supervisory authority to verify compliance with Article 33.

Why it matters

The duty that actually fires for most readers. It applies to every breach, including the ones you decide not to notify, and the documentation has to let a regulator check that decision.

Sources

• intersoftco2026article