Art. 27 GDPR – Personal Data Breach Notification – EDPB Guideline 09/2022

Our Art. 27 GDPR Rep Clients may already be aware of the so-called “one-stop shop”-concept. This concept would be practical within the context of notifying the authorities about a potential data breach (Art. 33 GDPR), since an organization would only need to notify the authorities of the country where the data controller or the data processor has its representative. Lately, however, there have been talks on abolishing the one-stop-shop, which would mean that the potential breach will need to be notified to every supervisory authority for which affected data subjects reside in their Member State, according to Footnote 37 of the Guidelines 9/2022 on personal data breach notification under GDPR, which were published on March 28, 2023. The essential difficulties that come from this decision are not to be taken lightly: keeping within the 72-hour notification breach is to be considered the main issue. It remains to be seen how this decision is going to be implemented in practice as well as how the EU data protection authorities will work with one another to facilitate the settlement of the notification procedure. DP-Dock offers its services in multiple EU languages, thus facilitating the, by now, rather complex notification process, and is providing assistance in the cross-notification obligation of the Controller.

More information here