Notification of a personal data breach to the supervisory authority

frameworkGDPR sectionRequirements csf 2.0ID.IM-04 RS.CO-02 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 topicsIncident Response, Reporting frameworks0 12 1

Official text · not licensableSee the official text of GDPR.

gap from GDPR → gap to GDPR →

Wrong or missing mapping? Report it

Equivalents of Art.33(1) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-04 RS.CO-02 RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; Internal and external stakeholders are notified of incidents…	Editorial	Same topic: Incident Response, Reporting (editorial pick)
ISO 27001	A.5.5 A.5.24 A.5.25 A.5.26 A.6.8	Contact with authorities; Information security incident management planning and preparation…	Editorial	Same topic: Reporting, Incident Response (editorial pick) 3 loosely related (not mappings) A.5.27 Learning from information security incidents Loosely related Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping A.5.28 Collection of evidence Loosely related Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping Clause 7.4 Communication Loosely related Only shares CSF RS.CO-02: related, not a mapping
CIS v8.1	CIS 17.1 CIS 17.3 CIS 17.4 CIS 17.5 CIS 17.7 CIS 17.9	Designate Personnel to Manage Incident Handling; Establish and Maintain an Enterprise Process for Reporting Incidents…	Editorial	Same topic: Incident Response, Reporting (editorial pick) 1 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RS.CO-02: related, not a mapping
SOC 2	CC2.3 CC7.3 CC7.4	Communication with external parties; Evaluating security events to determine if they are incidents…	Editorial	Same topic: Reporting, Incident Response (editorial pick)
PCI DSS	12.10.1 12.10.2 12.10.3 12.10.4	Incident response plan ready to activate; Incident response plan reviewed and tested annually…	Editorial	Same topic: Incident Response, Reporting (editorial pick) 5 loosely related (not mappings) 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RS.MA-02, RS.MA-03: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF ID.IM-04, RS.MA-03: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF RS.MA-02: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF RS.CO-02: related, not a mapping
CMMC	IR.L2-3.6.1 IR.L2-3.6.2 IR.L2-3.6.3	Incident Handling; Incident Reporting…	Editorial	Same topic: Incident Response, Reporting (editorial pick)
800-53	IR-2 IR-3 IR-4 IR-6 IR-8	Incident Response Training; Incident Response Testing…	Editorial	Same topic: Incident Response, Reporting (editorial pick) 4 loosely related (not mappings) IR-5 Incident Monitoring Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.CO-02, RS.MA-01, RS.MA-04: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RS.CO-02, RS.MA-01: related, not a mapping
HIPAA	§164.308(a)(6)§164.308(a)(6)(ii)	Security Incident Procedures; Response and Reporting	Editorial	Same topic: Incident Response, Reporting (editorial pick) 4 loosely related (not mappings) §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RS.CO-02, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping
NIS2	3.1 3.3 3.5	Incident handling policy; Event reporting…	Editorial	Same topic: Incident Response, Reporting (editorial pick) 2 loosely related (not mappings) 3.4 Event assessment and classification Loosely related Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF RS.CO-02: related, not a mapping
Essential Eight	ISM-0123 ISM-0140 ISM-1819	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or……	Editorial	Same topic: Reporting, Incident Response (editorial pick)
DORA	Art.11(2)(b)Art.17(1)Art.17(3)Art.18(1)Art.19(1)Art.19(3)Art.19(4)	Response and recovery; ICT-related incident management process…	Editorial	Same topic: Incident Response, Reporting (editorial pick)
CPS 234	Para 23 Para 24 Para 25 Para 26 Para 35 Para 36	Detect and respond to incidents in a timely manner; Maintain information security response plans…	Editorial	Same topic: Incident Response, Reporting (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.