Personal data breach register (GDPR Article 33(5))

A personal data breach register is the internal record in which a controller logs every personal data breach, notified or not, as Article 33(5) of the GDPR (General Data Protection Regulation) requires. On December 15, 2020, Ireland's Data Protection Commission (DPC) announced a 450,000 euro fine against Twitter. In December 2018 a code defect had made protected tweets public. Notification came late, and the DPC found two infringements: Article 33(1) for the delay, and Article 33(5) because the breach was documented too poorly for the authority to reconstruct the facts without repeated queries. It was also the first decision to go through the Article 65 dispute resolution procedure at the EDPB (European Data Protection Board). The text is short. The controller documents any personal data breach, comprising the facts, its effects and the remedial action taken, and that documentation lets the authority verify compliance with Article 33. Any breach: one left unnotified because it posed no risk belongs in the register too, with the reasoning that concluded there was no risk. In an audit, the CNIL (Commission nationale de l'informatique et des libertés) asks for the register early. An empty register at a 3,000-person organization reassures nobody: it suggests incidents go undetected, which leads straight back to Article 32. For the underwriter, the register works twice. At underwriting, it shows actual incident frequency better than any application form, and a broker who summarizes it cleanly often gets a shorter conversation. At claim time, it can work against the insured: the March entry that already describes the anomalous access gives the carrier grounds for a prior knowledge argument, or for a circumstance not disclosed at renewal. Keeping the register costs almost nothing and no policy pays for it; keeping it badly makes the regulatory investigation cover work harder.