Why Documentation Matters in a Breach
Failing to document a breach, even if not reportable, could still cost you. Here’s what you must log.
UK GDPR Article 33(5) requires you to document all breaches — whether or not they are reported to the ICO.
Each record should include:
- Date and time of breach discovery
- Description of the breach
- Impact assessment
- Actions taken
This record must be made available to the ICO if requested.
Good documentation shows you’re in control — and it could save you in an audit or investigation.
