Europejska Rada Ochrony Danych, Guidelines 9/2022 on personal data breach notification under GDPR

Guidelines 9/2022 on personal data breach notification under GDPR

Version 2.0

Adopted 28 March 2023

The European Data Protection Board

Having regard to Article 70(1)(e) and (l) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter “GDPR”),

Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 ,

Having regard to Article 12 and Article 22 of its Rules of Procedure, Having regard to the Article 29 Working Party Guidelines on Personal data breach notification under Regulation 2016/679, WP250 rev.01,

HAS ADOPTED THE FOLLOWING GUIDELINES

0 PREFACE

1. On 3 October 2017, the Working Party 29 (hereinafter “WP29”) adopted its Guidelines on Personal data breach notification under...