The GDPR and NIS2 clocks
Every incident shows a countdown from the moment you became aware of it. A personal-data breach runs the GDPR Article 33 clock: 72 hours to notify the supervisory authority, weekends included. A significant NIS2 incident runs the Article 23 milestones: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Record when each was sent and the clock moves to the next.
Dazr records the fields and timestamps; filing still happens in your authority's own portal. Try the free breach deadline calculator.
Is it significant under NIS2?
The significant-incident checker walks through the criteria of Implementing Regulation (EU) 2024/2690 for the digital-infrastructure and digital-provider entities it covers, using the entity types and turnover in your compliance profile. The outcome, the matching criteria and the time of the check are stored with the incident, and a significant result switches on the NIS2 milestones. There is also a free NIS2 significant-incident checker on this site.
What an incident record holds
- Type (twelve, from data breach and ransomware to vendor and physical incidents), severity and status from investigating to closed.
- When it occurred, was detected, contained, eradicated and resolved, and by whom.
- The Article 33 fields: affected data types and approximate number of data subjects, likely consequences, measures taken, DPO contact, the authority, the date reported and the case reference, and whether data subjects were notified.
- A timeline of events, root cause, mitigation and lessons learned, with a link to a corrective control or task.
- An incidents-by-severity chart on the register, and the register in Excel and CSV exports.
A public breach-report portal
On Enterprise, an admin switches on a reporting page and shares its link. Anyone can report a suspected breach without an account: plain questions and a screenshot upload. An email-domain allow-list, a proof-of-work check and hourly and daily caps keep spam out. Reports land in a queue your security lead approves into the incident register, or rejects.
On a phone when it matters
The portal works on a phone, in English, Dutch, Italian, German, French, Spanish and Polish, for the moments an incident does not wait for a laptop. Members are assigned incidents, auditors add notes, and webhooks on Enterprise send incident events to your ticketing or chat.
