Communication of a personal data breach to the data subject

frameworkGDPR sectionRequirements csf 2.0RC.CO-03 RC.CO-04 RC.RP-05 RS.CO-02 topicsReporting, Comms & Restore frameworks0 12 1

Official text · not licensableSee the official text of GDPR.

gap from GDPR → gap to GDPR →

Wrong or missing mapping? Report it

Equivalents of Art.34(1) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	RC.CO-03 RC.CO-04 RC.RP-05 RS.CO-02	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders; Public updates on incident recovery are shared using approved methods and messaging…	Editorial	Same topic: Comms & Restore, Reporting (editorial pick)
ISO 27001	A.5.5 A.5.26 A.6.8 Clause 7.4	Contact with authorities; Response to information security incidents…	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 1 loosely related (not mappings) A.5.28 Collection of evidence Loosely related Only shares CSF RC.CO-03: related, not a mapping
CIS v8.1	CIS 17.3 CIS 17.6	Establish and Maintain an Enterprise Process for Reporting Incidents; Define Mechanisms for Communicating During Incident Response	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 2 loosely related (not mappings) CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Loosely related Only shares CSF RC.CO-04, RS.CO-02: related, not a mapping CIS 11.1 Establish and Maintain a Data Recovery Process Loosely related Only shares CSF RC.RP-05: related, not a mapping
SOC 2	CC2.3 CC7.5	Communication with external parties; Recovering from identified security incidents	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 2 loosely related (not mappings) A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF RC.RP-05: related, not a mapping A1.3 Testing recovery plan procedures Loosely related Only shares CSF RC.RP-05: related, not a mapping
PCI DSS	12.10.1	Incident response plan ready to activate	Editorial	Same topic: Reporting (editorial pick) 7 loosely related (not mappings) 12.10.3 Incident response staff available around the clock Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF RC.RP-05: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF RC.RP-05: related, not a mapping 11.4.4 Penetration test findings corrected and retested Loosely related Only shares CSF RC.RP-05: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF RC.CO-03: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF RS.CO-02: related, not a mapping
CMMC	IR.L2-3.6.2	Incident Reporting	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 1 loosely related (not mappings) IR.L2-3.6.1 Incident Handling Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02: related, not a mapping
800-53	CP-10 IR-6	System Recovery and Reconstitution; Incident Reporting	Editorial	Same topic: Comms & Restore, Reporting (editorial pick) 6 loosely related (not mappings) IR-4 Incident Handling Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02: related, not a mapping SR-8 Notification Agreements Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping CP-2 Contingency Plan Loosely related Only shares CSF RC.CO-04: related, not a mapping CP-7 Alternate Processing Site Loosely related Only shares CSF RC.RP-05: related, not a mapping IR-7 Incident Response Assistance Loosely related Only shares CSF RS.CO-02: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF RS.CO-02: related, not a mapping
HIPAA	§164.308(a)(6)(ii)	Response and Reporting	Editorial	Same topic: Reporting (editorial pick) 12 loosely related (not mappings) §164.308(a)(6) Security Incident Procedures Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Loosely related Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Loosely related Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Loosely related Only shares CSF RC.CO-03, RS.CO-02: related, not a mapping …and 4 more in the downloads
NIS2	3.3 4.3	Event reporting; Crisis management	Editorial	Same topic: Reporting, Comms & Restore (editorial pick) 1 loosely related (not mappings) 3.5 Incident response Loosely related Only shares CSF RC.CO-03, RC.CO-04, RS.CO-02: related, not a mapping
Essential Eight	ISM-0123 ISM-0140	Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or…	Editorial	Same topic: Reporting (editorial pick) 1 loosely related (not mappings) ISM-1515 Restoration of data, applications and settings from backups to a common point in time… Loosely related Only shares CSF RC.RP-05: related, not a mapping
DORA	Art.11(2)(e)Art.11(7)Art.18(1)Art.19(1)Art.19(3)Art.19(4)	Response and recovery; Response and recovery…	Editorial	Same topic: Comms & Restore, Reporting (editorial pick) 2 loosely related (not mappings) Art.11(6) Response and recovery Loosely related Only shares CSF RC.RP-05: related, not a mapping Art.12(4) Backup policies and procedures, restoration and recovery procedures and methods Loosely related Only shares CSF RC.RP-05: related, not a mapping
CPS 234	Para 35 Para 36	Notify APRA of material incidents within 72 hours; Notify APRA of material control weaknesses within 10 business days	Editorial	Same topic: Reporting (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.