# Standards and Regulatory References — Breach Documentation Records

## Primary Legislation

### GDPR Article 33(5) — Breach Documentation Obligation
- "The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article."
- The obligation is universal — applies to ALL breaches, not only those notified to the SA.

### GDPR Article 5(2) — Accountability Principle
- "The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')."
- The breach register is a primary accountability document demonstrating compliance with Art. 32 (security) and Art. 33/34 (notification).

### GDPR Article 24(1) — Controller Responsibility
- Controllers must implement appropriate measures to demonstrate that processing complies with the GDPR. The breach register is evidence of such measures.

### GDPR Recital 87 — Documentation Purpose
- Documentation should enable supervisory authorities to verify compliance with notification obligations and assess whether the controller responded appropriately.

## Regulatory Guidance

### EDPB Guidelines 9/2022 — Section 5: Documentation
- Section 5.1: All breaches must be documented, including those assessed as not requiring SA notification.
- Section 5.2: Documentation should be sufficient for the SA to verify the controller's compliance, including the reasoning behind notification decisions.
- Section 5.3: The breach register should be maintained as a living document, updated as new information emerges and remediation progresses.

### ICO (UK) — Breach Record Keeping Guidance
- The ICO expects the register to be "a complete and accurate account of every breach."
- The ICO may request the register during audits, investigations, or in response to data subject complaints.
- Failure to maintain adequate breach records is itself a compliance deficiency.

### CNIL (France) — Registre des Violations de Données
- CNIL provides a template breach register with 14 mandatory fields.
- The register must be maintained in electronic form and available for inspection.
- CNIL expects the register to demonstrate that the controller's assessment of notification requirements was conducted properly.

## Enforcement Precedents

- **Belgian DPA — Decision 80/2021**: Controller fined for failing to document a breach in the Art. 33(5) register, even though the breach was notified to the SA. The register must be complete.
- **Spanish AEPD — PS/00547/2021**: Sanction for inadequate breach documentation — the controller could not produce evidence of its notification decision rationale.
- **Romanian ANSPDCP — Fine of EUR 15,000 (2019)**: Incomplete breach register missing effects and remedial actions for documented breaches.
- **Hellenic DPA — Decision 26/2019**: Fine of EUR 150,000 (partly) for failure to maintain adequate breach records and demonstrate accountability.

## ISO/IEC Standards

- **ISO/IEC 27001:2022** — Annex A Control 5.24 (Information security incident management planning and preparation): Requires documented procedures for managing information security incidents.
- **ISO/IEC 27001:2022** — Annex A Control 5.26 (Response to information security incidents): Requires documented evidence of incident response activities.
- **ISO/IEC 27701:2019** — Section 6.13.1.5: Requires documented records of privacy breach notifications, decisions, and outcomes.
- **ISO/IEC 27035-1:2023** — Section 7.5: Documentation requirements for incident management records including: incident report, investigation findings, corrective actions, and lessons learned.