A breach register, with every deadline already counted.
Privacyboard keeps the register of personal data breaches that the GDPR asks for. Record what happened, assess the risk, and see which authority and which people to notify, and by when, in the countries you serve. It is free on every plan.
Free to set up · No credit card · About 5 minutes
In short
- Records
- Every breach, including the ones you do not notify
- Deadline
- 72 hours under the GDPR, from when you became aware
- Countries
- The authority and deadline for each country you serve
- Cost
- Free on every plan, exported as PDF or Excel
Decide how serious it is
Four levels, each with what it means and what to do next. Deadlines start when you become aware, so the register asks you to assess quickly.
Who to notify, country by country
Pick the countries you serve once. Each incident then shows the authority to notify and its deadline, with your lead European authority named for you.
Every incident, in one register
Notified or not, each breach keeps its facts, its decision and its dates. Export the register for an authority or an auditor.
Where it fits
Everything sits in one workspace: say a thing once, and every document that depends on it follows.
What is a data breach register?
A personal data breach is any incident that exposes, changes or loses personal data: an email sent to the wrong person, a lost laptop, a hacked account, a deleted database. The GDPR asks you to document every breach, with the facts, its effects and what you did about it, whether or not you notify it.
Notification depends on the risk. When people could be harmed, the supervisory authority must be told within 72 hours of becoming aware; when the risk is high, the people concerned must be told too. Under pressure, the hard part is knowing who to tell and by when. The register shows it for each incident.
How it works
- 1
Record the incident
Describe what happened, when you discovered it, the data and the people affected, the likely consequences and the measures you took.
- 2
Assess the risk
Choose no risk, risk or high risk. The incident then shows which authority and which people to notify, and the deadline in each country you serve.
- 3
Notify and close
Record the date you notified the authority and the people concerned, or mark a notice as not required with the reason, then close the incident.
What you get
Four levels of risk
Not assessed, no risk, risk and high risk, each with what it means and what to do next.
The 72-hour clock
Each incident to notify shows the GDPR deadline and warns you once it has passed.
Who to notify, by country
Your lead European authority named for you, plus the UK ICO, Switzerland, Canada with Québec, Brazil, Chile, Australia and US states.
Decisions in one line
Each incident sums up where things stand: assessed, notified, or not required and why.
Closed with a reason
An incident closes once its risk is assessed and each notice it needs is sent and dated, or marked not required.
Export for an authority
The whole register as a PDF or an Excel file, for an authority, an auditor or your own files.
Private by design
The register stays in your workspace and is never shown in your privacy center.
Linked to your assessments
Incidents about a tool appear in the risks of the impact assessments that involve it.
What the GDPR says about breaches
Other countries set their own authorities and deadlines. Privacyboard shows what the rules ask; deciding the risk stays with you, and a serious breach deserves professional advice.
- Article 33(1)
- Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people.
- Article 33(5)
- Document every personal data breach: the facts, its effects and the remedial action taken, so the authority can verify compliance.
- Article 34(1)
- When the breach is likely to result in a high risk, tell the people concerned without undue delay.
Say it once. It is true everywhere.
Your vendors, your answers and your cookie banner feed one workspace. Your policy, your records, your agreement and your privacy center are written from it, so a change is made once and nothing drifts.
A European service. Your workspace data is stored in the EU.
Other regimes, such as India’s DPDP Act, are not covered yet. Privacyboard is a guide, not legal advice.
Go online for free. Grow when you need to.
Your privacy center and cookie banner are online on the Free plan. Pro adds your requests, your domains and your team; Business, your brand only and the evidence pack.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy policy and documents drafted for youDrafted from the tools you really use, then reviewed and validated by you: privacy policy, cookie policy, data processing agreement and more.
- Vendor and processing registersYour tools and data activities in one register, with each vendor’s region, agreement and transfer details prefilled from our catalog.
- Privacy requests and breaches trackedEvery request and every personal data breach with its legal deadline and who to notify.
- Impact assessment screeningTells you which activities need a data protection impact assessment, and which transfers need a transfer impact assessment.
- Privacy center at yourcompany.privacyboard.ioYour policy, vendor list and documents on one public page, with your contact address and a “Powered by Privacyboard” mention.
- Cookie banner on 1 domain, 1,000 recorded choices a monthHolds back analytics and marketing tools until visitors agree, with a small Privacyboard link. Beyond 1,000 choices in a month, the banner keeps working but choices are not recorded.
- Real-browser scan of your site, twice a dayOpens your site in a real browser and lists the cookies and tools it finds, so your banner declares them all.
- 1 person
No card needed
ProRecommended
$32 per month
Billed $384 a year Save $84
For taking requests, covering all your sites and working as a team.
Start with ProEverything in Free, plus:
- Request form and replies from PrivacyboardA request form on your privacy center that lands in your inbox, and replies sent from Privacyboard under your company name.
- Your center on your own domainServe your privacy center at an address such as privacy.yourcompany.com, with one DNS record.
- Cookie banner on up to 3 domains, every choice recordedNo Privacyboard mention on the banner, and no monthly limit on recorded choices.
- Weekly scan of your websiteYour site is checked in a real browser every week, and you get an email when a new tool appears.
- Complete DPIAs and TIAsData protection and transfer impact assessments prefilled from your register and vendors, with PDF export.
- Claude and ChatGPT connectorAsk an AI assistant about your workspace: what is overdue, which vendors lack an agreement. Read-only.
- Up to 5 people, with rolesOwner, admin, editor and viewer. Pending invitations count toward the 5.
- Activity log, kept 13 months
- Support by email
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For proving it to customers and auditors, under your brand only.
Start with BusinessEverything in Pro, plus:
- Your brand onlyNo “Powered by Privacyboard” mention on your privacy center.
- Security section and vendor-list alertsShow your certifications and a security contact on your center, and let customers subscribe to an email when you add or remove a provider.
- Evidence pack in one clickOne dated file for audits and customer questionnaires: summary, registers, validated documents, requests, incidents and consent proofs.
- Cookie banner on up to 10 domains
- Daily scan of your websiteEvery day instead of every week, with an email when a new tool appears.
- Up to 50 people
- Two-step verification required for everyoneMembers without an authenticator app are asked to turn it on before they can open the workspace.
- Activity log, kept 3 years
- Priority support
- Single sign-on (SAML) and yearly bank transfer, on requestWrite to hello@privacyboard.io.
Bank transfer on request
Questions, answered.
What counts as a personal data breach?
Any incident that leads to personal data being exposed, changed, lost or destroyed, by accident or not: an email to the wrong person, a lost device, a hacked account or a deleted database.
Should I record a breach I do not notify?
Yes. The register must contain every breach, with the facts, the effects and what you did. Note why you decided not to notify.
Does Privacyboard notify the authority for me?
No. Each authority has its own form. The register tells you who to notify and keeps the dates and details you need to fill it in.
Is the register public?
No. It stays in your workspace and is never shown in your privacy center.
Is the breach register free?
Yes, on every plan, with PDF and Excel export. On Business, it is also part of the evidence pack.