Within the development of the European data protection framework, there has been an increasingly pronounced trend towards moving from abstractly formulated obligations to their detailed procedural standardisation. This trend is particularly evident in the area of personal data breach notification, where efforts are being made to ensure greater consistency in the actions of controllers and supervisory authorities.

In this context, the European Data Protection Board (“EDPB”) launched a public consultation on a Personal Data Breach Notification Model. The purpose of this document is to introduce a harmonised and structured Personal Data Breach Notification Model for notifications submitted to supervisory authorities within the GDPR framework, and to assist organisations in aligning and streamlining their personal data breach notification processes.

This document builds upon the existing regulatory framework, in particular Article 33 of the GDPR, which establishes the obligation to notify the supervisory authority of a personal data breach within 72 hours. Through this Notification Model, the EDPB introduces operational standardisation of the manner in which this obligation is fulfilled in practice, notably by harmonising the content and structure of personal data breach notifications.

The Notification Model will be subject to public consultation until 5 August 2026 and is available at the following link.

From Free-Text Descriptions to a Structured Model

To date, the practice of notifying supervisory authorities of personal data breaches has been based on a relatively flexible narrative description of the incident. The new EDPB Notification Model changes this approach by introducing a structured digital model in which information is collected through predefined categories.

The Notification is completed through a series of fields that guide the controller in identifying the type of breach, describing the circumstances of the incident, classifying the breach, specifying the categories of personal data concerned, the number of data subjects affected and personal data records concerned, as well as providing information on the technical and organisational measures implemented.

In addition, certain responses automatically trigger additional questions (fields), meaning that the Notification Model operates as a guided system rather than a free-text report.

The Notification Model also provides for multi-stage reporting, whereby the notification itself indicates whether it is being submitted as an initial notification or as a supplementary notification. In the latter case, it also allows for the withdrawal of a previously submitted notification. In practical terms, this means that previously submitted notifications can be managed through the Notification Model, including by supplementing or withdrawing them, subject to the provision of identifying information relating to the earlier notification.

Standardisation of Risk and Impact Assessment

Under the new Notification Model, risk assessment is further structured through predefined categories. Rather than relying on an open-ended legal assessment, the Model introduces predefined options relating to the types of incidents involved and their potential impact on data subjects.

When completing the notification, the controller is required to select one of the predefined categories relating, inter alia, to the likely consequences of a personal data confidentiality breach (for example, where personal data has been disclosed outside the scope of the privacy policy or applicable legal requirements, or where the data may be used for purposes other than those originally intended) or to the nature of the potential consequences for the data subject (for example, restriction of the data subject’s rights, financial loss, identity theft or identity misuse, etc.).

Regarding risk assessment, the controller is required, within the notification itself, to select one of the available options reflecting the outcome of the risk assessment. The available categories are: a personal data breach likely to result in a high risk to the rights and freedoms of data subjects; a personal data breach likely to result in a low risk; and a personal data breach that is unlikely to result in a risk to the rights and freedoms of data subjects.

This achieves greater comparability between Notifications submitted by different controllers, while at the same time reducing the scope for individualized legal qualification of complex cases. In practice, this leads to greater administrative consistency, but also to a strengthening of a form-based approach to risk assessment.

The Relevance of the EDPB Notification Model for the Domestic Context

The obligation to notify a personal data breach is not new under domestic law either. The Personal Data Protection Act largely follows the solutions of the GDPR and provides that the controller is obliged to notify the Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Similar to Article 33 of the GDPR, the notification must include a description of the nature of the breach, the categories and approximate number of data subjects concerned, the possible consequences of the breach, as well as the measures taken or proposed to address the breach and mitigate its effects. In addition, the content of the notification is further elaborated in the Rulebook on the Personal Data Breach Notification Form, adopted by the Commissioner with a view to harmonising breach notification practices.

In this context, the EDPB Notification Model does not introduce a completely new concept, but rather represents a step towards further standardisation and harmonisation of the personal data breach notification process at the level of the European Union. Its significance for Serbian controllers lies precisely in the fact that it provides insight into the expectations of European supervisory authorities regarding the scope, structure and level of detail expected when reporting incidents. The EDPB has stated that the objective of the Notification Model is to ensure that notifications contain the information required under Article 33 of the GDPR, while promoting greater consistency and uniformity in the practices of supervisory authorities across the EU.

From Standardisation to New Expectations

The EDPB Notification Model does not introduce any new substantive obligations for controllers, nor does it alter the requirements of Article 33 of the GDPR. Its significance lies primarily in standardising the manner in which existing obligations are fulfilled in practice and in seeking to achieve greater consistency in the actions of supervisory authorities across the European Union.

For organisations operating across multiple markets or seeking to align their processes with European standards, the Notification Model serves as a useful indicator of regulatory expectations regarding the content, structure and level of detail expected when reporting personal data breaches. Regardless of the outcome of the public consultation, it is clear that the regulatory focus is increasingly shifting from the question of whether an incident must be reported to the question of how that obligation is documented, substantiated and implemented in practice.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.