# Standards and Regulatory References — Breach Risk Assessment

## Primary Legislation

### GDPR Article 33(1) — Notification Threshold
- Notification required "unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons."
- The burden of demonstrating that a breach is "unlikely to result in risk" rests with the controller.
- The assessment must be made at the time of becoming aware, based on information reasonably available.

### GDPR Article 34(1) — High Risk Threshold
- Communication to data subjects required "when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons."
- "High risk" is a higher threshold than "risk" — not every notifiable breach under Art. 33 triggers Art. 34.

### GDPR Recital 75 — Types of Risk
Identifies the following as relevant risks to rights and freedoms:
- Physical, material, or non-material damage
- Discrimination
- Identity theft or fraud
- Financial loss
- Unauthorized reversal of pseudonymisation
- Damage to reputation
- Loss of confidentiality of professional secrecy
- Any significant economic or social disadvantage

### GDPR Recital 76 — Risk Assessment Methodology
- Risk should be evaluated on the basis of an objective assessment.
- Account should be taken of the nature, scope, context, and purposes of the processing.
- Risk should be determined on the basis of the likelihood and severity of the potential harm.

## EDPB Guidance

### EDPB Guidelines 9/2022 on Personal Data Breach Notification (Version 2.0)
- Section 3.1: Provides the structured risk assessment framework used in this skill.
- Section 3.2: Distinguishes between "risk" (Art. 33 threshold) and "high risk" (Art. 34 threshold).
- Section 3.3: Factors to consider include type of breach, nature/sensitivity/volume of data, ease of identification, severity of consequences, special characteristics of the individuals, special characteristics of the controller, and the number of affected individuals.

### EDPB Guidelines 01/2021 on Examples Regarding Data Breach Notification
- Provides 18 detailed breach scenarios with risk assessments and notification recommendations.
- Organized by breach type: ransomware, data exfiltration, human error, lost/stolen devices, social engineering, and mispostal.
- Each scenario includes: case summary, prior measures, risk assessment, mitigation and obligations, and case-specific remarks.

### WP29 Guidelines on Data Protection Impact Assessment (WP248 rev.01)
- Section III.B: Criteria for identifying high-risk processing — applicable by analogy to breach risk assessment.
- Nine criteria include: evaluation/scoring, automated decision-making, systematic monitoring, sensitive data, large scale, dataset matching, vulnerable data subjects, innovative use, and cross-border processing.

## National Supervisory Authority Guidance

### ICO (UK) — Assessment of Risk in Breach Notification
- The ICO applies a two-part test: (1) What is the likelihood of harm? (2) What is the severity of harm?
- Provides a risk matrix with likelihood (remote, possible, probable) and severity (minimal, significant, severe) dimensions.
- Published case studies illustrating assessment outcomes for common breach types.

### CNIL (France) — Methodology for Breach Severity Assessment
- CNIL uses a four-level severity scale: negligible, limited, significant, maximum.
- Considers both the nature of the data and the volume of affected individuals.
- Published a decision tree for controllers to determine notification obligations.

### DSB (Austria) — Breach Risk Assessment Guidance (2023)
- Emphasizes that the assessment must be documented contemporaneously, not retroactively.
- Controllers must be able to produce the risk assessment upon request by the authority.

## Enforcement Precedents

- **AEPD (Spain) — PS/00030/2022**: EUR 70,000 fine for failing to properly assess breach risk and delaying notification based on an inadequate risk assessment that underestimated consequences.
- **ICO (UK) — British Airways (2020)**: Original notice of intent for GBP 183 million (reduced to GBP 20 million) — the scale of the breach and the failure to detect it promptly were aggravating factors in the risk assessment.
- **CNIL (France) — Dedalus Biologie (2022)**: EUR 1.5 million fine — health data breach affecting 491,939 patients. The risk assessment was unambiguously high risk given the nature (medical records) and volume of data.
- **AP (Netherlands) — Transavia Airlines (2021)**: EUR 400,000 fine — breach involving access to 83,000 passenger records. The risk assessment considered the combination of names with travel booking details as sufficient for identification and potential harm.

## ISO/IEC Standards

- **ISO/IEC 27005:2022**: Information security risk management. Provides the general risk assessment framework (context establishment, risk identification, risk analysis, risk evaluation) that underpins breach-specific assessments.
- **ISO/IEC 29134:2023**: Guidelines for privacy impact assessment. Section 7.2.2 provides a privacy risk assessment methodology that can be adapted for breach risk assessment.
- **ISO/IEC 27701:2019**: Section 6.13.1: Requires the organization to establish, implement, and maintain processes for identifying, evaluating, and reporting privacy breaches including a documented risk assessment methodology.