# Breach notification

URL: /systems/trust-and-governance/controls/breach-notification · Id: `control:breach-notification`

> A personal data breach notifies every affected Person and authority within the legal deadline, scoped by an exact query.

A personal data breach notifies every affected [Person](/business/nouns/person) and authority within the legal deadline, scoped by an exact query.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC7.3](/systems/trust-and-governance/criteria/soc2/cc7-3) | The entity evaluates security events to determine whether they are incidents that require a response. |
| [SOC2 P6.3](/systems/trust-and-governance/criteria/soc2/p6-3) | The entity keeps a complete, accurate and timely record of detected or reported unauthorized disclosures, including breaches. |
| [SOC2 P6.6](/systems/trust-and-governance/criteria/soc2/p6-6) | The entity notifies affected data subjects, regulators and others of breaches and incidents. |
| [HIPAA 164.404](/systems/trust-and-governance/criteria/hipaa/164-404) | A covered entity notifies each affected individual of a breach of unsecured protected health information without unreasonable delay. |
| [GDPR Art.33](/systems/trust-and-governance/criteria/gdpr/art-33) | A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible. |
| [GDPR Art.34](/systems/trust-and-governance/criteria/gdpr/art-34) | A controller tells data subjects without undue delay about a breach likely to put them at high risk. |

## Implemented by
- [Privacy](/workflows/processes/privacy)
- [Incident response](/workflows/processes/incident-response)
- [Privacy](/systems/privacy)
- [Notices](/systems/notices)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident that touched a personal field in the report period. |
| Assert | Each lists every affected Person, and every required notice went out within its legal deadline. |

## Owner
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

## Example
A leaked export token reads 312 tutoring-marketplace parents' emails. One query lists exactly those 312 [People](/business/nouns/person), and each one, plus the authority, gets notice inside 72 hours.