GDPR · written for security teams
GDPR, translated for the people who secure the systems.
Article 32 security, the 72-hour breach clock, DPIAs, records, retention, encryption, processors, transfers and NIS2, explained article by article, with the controls, playbooks and evidence that make compliance real.
- areas
- 10
- in-depth guides
- 10
- glossary terms
- 13
- T+0hAware of a personal data breachArt. 4(12)
- T+2hContain and preserve evidence
- T+24hAssess the risk to individualsArt. 33(1)
- T+48hDraft the notificationArt. 33(3)
- T+72hNotify the supervisory authorityArt. 33
- ASAPInform people if the risk is highArt. 34
Illustrative internal timeline. The legal rule: notify without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33).
The map
Ten areas where the GDPR meets your security programme
Each area anchors on the articles that create the obligation, then turns them into engineering: controls, workflows, configuration and evidence.
Clocks to know
The deadlines your incident process has to respect
- to notify the supervisory authority of a personal data breach, where feasible, after becoming aware of it
- 72 h
- GDPR Art. 33(1)
- to inform affected people when a breach is likely to result in a high risk to them
- No undue delay
- GDPR Art. 34(1)
- NIS2 early warning for a significant incident, followed by a notification within 72 hours
- 24 h
- NIS2 Art. 23(4)
- NIS2 final report, counted from the incident notification
- 1 month
- NIS2 Art. 23(4)(d)
Who it is for
One regulation, three conversations
CISOs & security managers
Map Art. 32 to your control framework, prioritise by risk to people, and show accountability to the board, auditors and regulators.
Engineers, SOC & IR
Build retention, pseudonymisation and logging that hold up, and run a breach playbook that meets the 72-hour clock without guesswork.
Working with your DPO
Speak the same language as privacy and legal: records of processing, DPIAs, processor contracts and transfer assessments.
Guides