A board asks the privacy team for ‘EDPB-aligned’ scoring when deciding whether a breach requires supervisory-authority or individual notification. How should EDPB materials factor into that assessment?
Select an answer to reveal the explanation.
Short Explanation
Use the EDPB’s breach playbooks as a compass next to the GDPR text—not as scrap paper and not as a full rewrite of the Articles. Risk scoring for who to notify gets clearer with that guidance. Internal spreadsheets still need that legal north star.
Full Explanation
EDPB guidelines and opinions help inform breach-notification risk assessment alongside the GDPR’s risk thresholds in Articles 33 and 34. Boards asking for EDPB-aligned scoring should use those materials as interpretive aids, not ignore them because an internal spreadsheet exists, and not treat them as a full replacement of the Regulation. Only national criminal codes are not the sole permissible input. Exam caveat: EDPB guidance complements Articles 33/34—it neither voids nor replaces them. Operational check: adopt an EDPB-referenced breach risk matrix in the civic incident playbook, cite which guideline factors were applied, and retain the scoring with the awareness timestamp for accountability. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis. Confirm the analysis against the GDPR text and competent supervisory guidance before relying on it in production systems.