{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Internal register of personal data breaches (GDPR art. 33 (5)) - Belgium","description":"The controller's own documentation of every personal data breach: the facts, the effects and the remedial action taken (art. 33 (5)), with whether and when the breach was notified to the supervisory authority and communicated to the persons concerned. It is not the notification to the authority itself. An empty breaches list states that no breach was recorded.","type":"object","required":["holder","register","breaches"],"additionalProperties":false,"properties":{"holder":{"type":"object","description":"The controller that keeps the register.","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"enterprise_number":{"type":"string","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"},"address":{"type":"string"}}},"register":{"type":"object","required":["updated_on"],"additionalProperties":false,"properties":{"reference":{"type":"string"},"updated_on":{"type":"string","format":"date","description":"Date of this version of the register."},"kept_by":{"type":"string","description":"Person or function who keeps the register."}}},"breaches":{"type":"array","items":{"type":"object","required":["reference","discovered_on","facts","effects","remedial_action","risk_assessment","authority_notified","persons_informed"],"additionalProperties":false,"properties":{"reference":{"type":"string","minLength":1},"occurred_on":{"type":"string","format":"date","description":"Date the breach occurred, when it is known."},"discovered_on":{"type":"string","format":"date","description":"Date the controller became aware of the breach."},"discovered_by":{"type":"string","description":"Who detected or reported the breach."},"facts":{"type":"string","minLength":1,"description":"The facts relating to the breach (what happened)."},"data_categories":{"type":"array","items":{"type":"string"}},"data_subject_categories":{"type":"array","items":{"type":"string"}},"approx_persons":{"type":"integer","minimum":0,"description":"Approximate number of persons concerned, where it can be given."},"approx_records":{"type":"integer","minimum":0,"description":"Approximate number of records concerned, where it can be given."},"effects":{"type":"string","minLength":1,"description":"The effects (likely consequences) of the breach."},"remedial_action":{"type":"string","minLength":1,"description":"The remedial action taken."},"risk_assessment":{"type":"string","enum":["unlikely_to_result_in_risk","risk","high_risk"],"description":"The controller's assessment of the risk to the rights and freedoms of natural persons."},"authority_notified":{"type":"boolean","description":"Whether the breach was notified to the supervisory authority."},"authority_notified_on":{"type":"string","format":"date"},"authority_reference":{"type":"string","description":"Reference of the notification, where the authority gave one."},"delay_reasons":{"type":"string","description":"Reasons for a notification made later than 72 hours after awareness."},"not_notified_reason":{"type":"string","description":"Why the breach was not notified."},"persons_informed":{"type":"boolean","description":"Whether the breach was communicated to the persons concerned."},"persons_informed_on":{"type":"string","format":"date"},"persons_information_means":{"type":"string","description":"How the persons were informed."},"not_informed_reason":{"type":"string","description":"Why the persons were not informed."},"closed_on":{"type":"string","format":"date","description":"Date the file was closed."}},"allOf":[{"if":{"properties":{"authority_notified":{"const":true}},"required":["authority_notified"]},"then":{"required":["authority_notified_on"]}},{"if":{"properties":{"persons_informed":{"const":true}},"required":["persons_informed"]},"then":{"required":["persons_informed_on"]}}]}}}}