How do we keep a register of personal data breaches?

Article 33(5) GDPR: the controller shall document any personal data breaches, comprising the facts, their effects and the remedial action taken. That documentation must enable the supervisory authority to verify compliance with that Article.

The word "any" is the key. The 72-hour notification duty does not apply to every breach; the documentation duty does. So an email with personal data sent to the wrong person, a lost laptop with an encrypted disk, or a folder opened to a colleague by mistake – all of it goes in the register.

The European Data Protection Board (EDPB) adds one more thing in its Guidelines 9/2022: record the reasoning behind your decisions. Especially when you decide not to notify VDAI.

The GDPR does not prescribe a format. The EDPB guidelines say the format is the controller's choice, but an entry should cover the causes, what happened, the personal data affected, the consequences and the remedial action. These 12 fields cover it:

Fields 9 and 10 record your decisions, so fill them in most carefully.

No. 3. Entered 2026-03-12.
Happened: 2026-03-11, 16:40. Became aware: 2026-03-12, 09:15, when the customer replied.
What happened: a sales manager sent an invoice to one customer with another customer's invoice attached. Cause: the wrong file was picked by hand.
Data: one private individual's name, address and invoice amount. People: 1.
Risk: unlikely to result in a risk. The recipient is a known business customer who confirmed in writing that the file was deleted; no financial or identity data that could enable fraud was involved.
VDAI: not notified – the breach is unlikely to result in a risk to the person's rights (Article 33(1) GDPR), reasons above.
Person: informed by phone on 2026-03-12, 11:00, although there is no high risk.
Action: recipient's confirmation received; since 2026-03-15 invoices are sent from the accounting system, not by hand.
Owner: head of administration. Status: closed 2026-03-15.

Note: the recipient's confirmation that the data was deleted does not undo the breach. It only lowers the risk, so it belongs in the risk assessment, not instead of an entry.

Article 33(1) GDPR lets you skip notifying VDAI only when the breach is unlikely to result in a risk to the rights and freedoms of natural persons. That is your conclusion, so you have to justify it.

This is not the legal test but a practical simplification of the EDPB risk factors. A good justification answers at least three questions:

1. Which data and how much? A name and email is one thing; a personal identification number or health data is quite another.
2. Who received it or could reach it? A known, trusted recipient or an unknown person?
3. Was the data protected? For example, an encrypted disk whose key was not lost with the device.

If the risk is high, you must also inform the people themselves (Article 34(1) GDPR). If you do not, because one of the exceptions in Article 34(3) applies – for example the data was encrypted – the EDPB recommends keeping evidence of that.

You must notify without undue delay; 72 hours is the outer limit, "where feasible". If you notify later, the notification must include the reasons for the delay (Article 33(1) GDPR). If you do not have all the information yet, it is better to notify on time and add information in phases (Article 33(4)) than to be late. The register's exact hour of awareness (field 3) shows when the clock started; together with the recorded reasons it can help show that a delay was justified.

If a supplier processes data on your behalf, it must notify you without undue delay (Article 33(2) GDPR). You decide whether to notify VDAI, and the entry goes into your register. The EDPB guidelines say the controller is considered aware once the processor has informed it – your 72 hours start then. So it is worth agreeing in the supplier contract how fast and with what information the supplier informs you.

One spreadsheet that only a few people can open is enough. The EDPB guidelines also allow breaches to be recorded together with the record of processing activities, as long as breach entries are easy to identify and can be produced on request.

The GDPR does not set a retention period for the register. Keep it long enough to prove compliance; if entries contain personal data, you set the period yourself, as for other data.

Create the 12-field sheet today, before a breach happens. When one does, the 72 hours start from the moment you become aware, and there will be no time to design a form. With the tool (in Lithuanian) you can check free of charge whether you must keep a record of processing activities – the breach register usually sits next to it.

Is the register mandatory if we had no breaches this year?
The duty is to document breaches. The law does not require an empty register, but a ready form saves time when the hours are counting.

Does a misdirected email go into the register?
Yes, if it contained personal data. It is a security breach, even if it is unlikely to result in a risk and VDAI does not need to be notified.

Can VDAI ask to see the register?
Yes. Article 33(5) GDPR says the documentation must enable the supervisory authority to verify compliance with that Article.

From when are the 72 hours counted?
From the moment the controller becomes aware of the breach. That is why field 3 has an hour, not just a date.

• What to do after a data security breach? (in Lithuanian)
• We sent data to the wrong person – do we have to report it? (in Lithuanian)
• How to reply to a VDAI enquiry? (in Lithuanian)

The law and the risk: GDPR audit, compliance documents and advice – dat.lt

• Documenting all breaches – Article 33(5) GDPR.
• Notifying VDAI without undue delay, at most within 72 hours, and reasons for delay – Article 33(1) GDPR; content of the notification – Article 33(3); notification in phases – Article 33(4).
• Processor's duty to notify the controller – Article 33(2) GDPR.
• Informing people where the risk is high – Article 34(1) GDPR; exceptions – Article 34(3).
• Accountability – Article 5(2) GDPR.
• Recording the reasoning, format and retention of the register – EDPB Guidelines 9/2022 on personal data breach notification, version 2.0, paragraphs 31, 34, 44, 114 and 121–126; a joint register with the record of processing – footnote 47.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). EDPB guidelines read from the official PDF (adopted 2023-03-28). This text is general information and is not individual legal advice.