# EU GDPR breach notification operations
> Source: https://legalcode.md/skills/legalcode-eu-gdpr-breach-notification-operations | [HTML version](https://legalcode.md/skills/legalcode-eu-gdpr-breach-notification-operations)

Runs the complete EU GDPR personal data breach response workflow from initial incident triage through post-incident remediation.

Runs the complete EU GDPR personal data breach response workflow from initial incident triage through post-incident remediation. Use when: (1) a data breach or security incident involving personal data has occurred or is suspected, (2) an organisation needs to determine whether GDPR Articles 33 or 34 notification obligations are triggered, (3) a controller or processor needs to manage the 72-hour notification clock and lead supervisory authority determination, (4) a phased or supplementary notification must be prepared under Art. 33(4), (5) an operator needs to draft the Art. 33 SA notification, Art. 34 data subject communication, or processor-to-controller notification, (6) a forensic coordination plan or post-breach mitigation playbook is required, (7) Art. 33(5) internal documentation must be produced for regulatory audit. Covers controller-only, processor-only, and hybrid scenarios. Embeds the ENISA SE severity formula (DPC × EI + CB), EDPB 01/2021 case taxonomy, cross-border one-stop-shop rules, and the Art. 34 exemptions. EU jurisdiction only (separate skill for UK GDPR/ICO). Designed as the native Legalcode replacement for imported breach-notification packs.

This skill manages the **end-to-end operational response** to a personal data breach under EU GDPR. It runs from initial incident triage through supervisory authority notification, data subject communication, and post-incident remediation. **Covers:** - Incident triage — does the event qualify as a personal data breach under Art. 4(12)? - Controller vs. processor role determination and obligation split - T0 clock establishment and 72-hour deadline management - ENISA severity scoring (SE = DPC × EI + CB) with full DPC/EI/CB tables - EDPB Guidelines 01/2021 case matching (18 reference scenarios) - Art. 33 supervisory authority notification decision and draft - Art. 33(2) processor-to-controller notification - Art. 33(4) phased/supplementary notification management - Art. 33(5) internal documentation obligation - Art. 34 data subject communication decision and draft (including exemptions) - Cross-border processing — lead supervisory authority determination - Forensic coordination and evidence preservation guidance - Tailored breach mitigation playbook - Post-incident remediation, DPIA update, and Art. 30 records revision - AI Act Art. 62 serious incident check (where AI systems are involved) - Assessment override documentation with regulatory risk warnings **Does not:** - Cover UK GDPR / ICO breach notification (separate skill required) - Replace legal advice or DPO professional judgment - Cover ...

## Jurisdictions

European Union



---
*Legalcode -- legalcode.md*