The elapsed time, in hours, between the data breach having been recognized or detected by the organisation and the personal data breach notification being submitted to the supervisory authority.
Describe the nature of the personal data breach, including, where possible:
Categories and approximate number of data subjects concerned
Categories and approximate number of personal data records concerned
The description should include the current understanding of how the breach occurred (e.g. unauthorised access, accidental) and any supporting information.
A description of what the likely effects on data subjects may be of the breach and the risks they may face, including potential timescales.
Describe the actions that have been taken prior to the notification to lessen the impact of the breach, stop any further breaches and otherwise address the risk to data subjects.
Describe the further actions that have been identified, but not yet taken, that may help to lessen the impact of the breach, stop any further breaches and otherwise address the risk to data subjects.
The GDPR requires that breaches of personal data that may result in a risk to the rights and freedoms of natural persons are notified to the supervisory authority without undue delay and, where feasible, not less than 72 hours after having become aware of it. If this timescale has not been met, the reasons for this should be stated here