Is this even notifiable?
Legal says maybe, IT says no, the DPO is on a train. The debate takes two days — and the deadline does not wait for it.
With LegiscopeA reasoned answer in three minutes, with the clock already counting.
Personal data breach responseDeadline · decisions · notifications
You have 72 hours.
Legiscope does the work in 3 minutes.
Legiscope keeps the incident facts, Article 33 deadline, notification decisions, reasoning and draft communications in one structured process. Your team reviews, decides and sends.
§ 1 One incident, fully worked through
Articles 33 and 34One guided incident workflow
Describe the incident. Legiscope structures the facts, calculates the deadline and prepares the response.
- The deadline, already calculated
Enter the moment of awareness. The Article 33 deadline and time remaining stay visible throughout the case.
- Know who must be notified
Legiscope assesses the supervisory authority and affected people separately, with the facts and reasoning behind each answer.
- Notification drafts, already prepared
The information required by Articles 33(3) and 34(2) is drafted from the case, ready for your team to review, approve and send.
- One complete incident record
Facts, decisions, reasons, response actions, drafts and lessons stay together in one editable case.
Incident · INC-04C7 · Art. 33 / 34 · Lovin’ Cuisine SAS
The spreadsheet that went to the wrong supplier
Time left to tell the authority · Art. 33(1)The incident, in short
19 h 04 m leftDue Mon 18 Aug · 09:12
Fri 09:12 · aware53 h spentMon 09:12 · due
Friday, 09:12 — a sales rep calls: the loyalty export just went to the wrong supplier contact. 2,300 customers — names, e-mails, purchase history. By 10:40 the recipient confirms deletion in writing. You paste the thread as it is; the record, both answers and the letter come back in three minutes.
Do you have to notify — and who?reasons on file
The supervisory authority · Art. 33(1)Yes — within 72 hours
The file left the organisation — a risk that is not “unlikely”.
PDFNotification letterDrafted · the 7 points of Art. 33(3)
The 2,300 people affected · Art. 34(1)No — no high risk
Ordinary data, one known recipient — and deletion confirmed in writing.
No letter — none requiredThe reason is recorded on the file
You decide, and you send — a no needs a written reasonIllustrative
§ 2 The problem this solves
and why 72 hours get missedA breach is a legal exam,
that starts at the worst possible hour.
Most teams meet Articles 33 and 34 for the first time mid-incident, with the clock already running. Legiscope makes the law the part that is already handled — the answer, the deadline and the letters arrive; the decisions stay yours.
72 hours, counted in someone’s head.
Aware Friday 09:12 means due Monday 09:12 — across a weekend. Most missed notifications are counting errors, not bad faith.
With LegiscopeComputed from the hour you became aware, per second. Red before it is late.
“Why did you not notify the people?”
The authority asks in writing. The email thread is archived, the person who decided has left, and “we discussed it” is not a record.
With LegiscopeThe answers, their reasons and the letters on one exportable record — Art. 33(5).
Before the next incident
Put the process in place before the clock starts.
See how Legiscope keeps the facts, deadline, notification decisions, reasoning and draft communications in one structured response.
Book your demo →