Data breach: does reporting to cyber insurance replace notifying CNPD?

Three recipients, three questions

Separate reporting to the insurer, notifying the competent supervisory authority and communicating with affected people. Each has its own requirements. Identify the business's role and involve its data-protection coordinator, including its data protection officer where appointed.

The controller must assess notification. Article 33's exception applies where the breach is unlikely to result in a risk to individuals' rights and freedoms. Communication to individuals has its own high-risk requirements and legal exceptions.

Sources: CNPD — Violação de dados ou data breach ↗ · CEPD — Orientações n.º 9/2022, versão 2.0 de 28/03/2023, disponibilizadas pela CNPD ↗

Do not wait for a final report

Where required, notify the authority without undue delay and, where feasible, within 72 hours of awareness. CNPD explains that the period runs continuously, including weekends and holidays. Information may be supplied in phases where necessary; delay requires justification.

Record the initial alert and the point at which awareness of the breach is established, including supporting facts. Do not automatically start the clock at the arrival of the final forensic report.

Sources: CEPD — Orientações n.º 9/2022, versão 2.0 de 28/03/2023, disponibilizadas pela CNPD ↗ · CNPD — Deliberação: notificação, prazo contínuo e documentação de violações ↗

Make a useful record without sharing the database

Our suggested fields are event type, systems, data categories, potentially affected people, known consequences, action taken and unresolved points. Record a task owner and information source.

Fictional example: a file is emailed to the wrong recipient. Record what was sent, to whom, discovery timing and measures actually confirmed. «The email was deleted» alone does not establish that no risk remains. Assessment depends on the facts.

Keep documentation even if assessment concludes notification is unnecessary, including reasons and subsequent revisions.

Sources: CNPD — Violação de dados ou data breach ↗

Involve appropriate support

Follow the incident plan and policy contacts without suspending assessment of legal duties. Obtain technical and legal support on the competent authority and any required communication to individuals, particularly across borders.

This guide does not decide whether a particular incident is notifiable or confirm insured expenses. For future protection, request a quote from RMACHADO describing activity and systems, without sending databases or credentials.