All breaches must be documented, including those you decide not to report. The register shows IMY that you assess breaches consistently.
Why it matters
For GDPR, breach register is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Record facts, effects and actions taken
- Record why you did or did not report
- Review the register for trends
Where to start
A simple spreadsheet is enough if it is kept up to date. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.