Art. 33 GDPR gives you 72 hours from becoming aware to notify the supervisory authority of a personal data breach. That clock runs through weekends too. Which is why SimpleAct calculates it automatically from the time of discovery when the incident is created – and sorts the incident list by it.

At a glance

Included from: Professional
Where in the app: Data protection → Data breaches
Output: An incident file with notification deadlines, root cause analysis and lessons learned
Legal basis: Art. 33, 34 GDPR
API: /api/v1/data-breaches

Two timestamps, one consequential difference

An incident carries two separate timestamps: when it was discovered and when it actually occurred. Only the first drives the deadline – the 72 hours start on becoming aware, not at the event. The distinction matters because months can lie between them, and the authority wants to know both.

If the discovery timestamp is corrected later, the deadline is recalculated. So you can capture an incident roughly at first and refine it later without the deadline being left wrong.

Status model

The status mirrors the real sequence – contain first, then notify, then inform data subjects, then close.

Status	Meaning
OPEN	Recorded, being worked on.
CONTAINED	Contained – the data leak is stopped, the follow-up is still running.
AUTHORITY_NOTIFIED	Notified to the supervisory authority, with timestamp and reference number.
SUBJECTS_NOTIFIED	Data subjects informed (Art. 34), with timestamp.
RESOLVED	Resolved from a technical standpoint.
CLOSED	Finally closed, including lessons learned.

What an incident records

Area	Fields
Scope	Affected data categories, number of affected people, and the assessed risk to those people (low, medium, high, unknown).
Notification duties	A flag each for authority and data subject notification, with timestamp, authority name and reference number. This also documents a decision not to notify.
Handling	Containment and mitigation actions, root cause, reporter, assignee, timestamps for resolution and closure.
Links	The affected AI system and processing record. That answers "which processing was affected" without research.
Lessons learned	What has to change so it does not happen again. This is the part authorities read when there is a repeat incident.

A data breach is not automatically an AI incident

GDPR data breaches and EU AI Act serious incidents have different triggers, recipients and deadlines. An incident can be both – then you track it in both registers, each with its own deadline and recipient. Recording it in one and forgetting the other is the most common mistake at this interface.

Notify even when unsure

Art. 33 requires notification unless a risk to rights and freedoms is unlikely. The burden of proving "unlikely" is yours. So record incidents you ultimately do not notify as well – the documented reasoning is the actual protection.