{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Personal Data Breach Notification to Supervisory Authority (Art. 33)","description":"Notification to be lodged with the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of the breach. Where the 72-hour deadline is missed, the notification must include the reason for the delay.","type":"object","required":["controller","breach","data_affected","consequences","measures"],"additionalProperties":false,"properties":{"reference":{"type":"string"},"notification_date":{"type":"string","format":"date"},"notification_time":{"type":"string","description":"Time of lodging (HH:MM local, time zone noted if relevant)."},"phased":{"type":"string","enum":["initial","supplementary","final"],"description":"Art. 33(4) allows phased notifications when full information is not yet available."},"authority":{"type":"object","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string"},"portal_case_number":{"type":"string"}}},"controller":{"type":"object","required":["name","address","contact_email"],"additionalProperties":false,"properties":{"name":{"type":"string"},"address":{"type":"string"},"contact_email":{"type":"string","format":"email"},"dpo_name":{"type":"string"},"dpo_email":{"type":"string","format":"email"},"dpo_phone":{"type":"string"},"representative":{"type":"string"}}},"breach":{"type":"object","required":["occurred_on","discovered_on","description","nature"],"additionalProperties":false,"properties":{"occurred_on":{"type":"string","format":"date"},"occurred_time":{"type":"string"},"discovered_on":{"type":"string","format":"date"},"discovered_time":{"type":"string"},"description":{"type":"string"},"nature":{"type":"array","items":{"type":"string","enum":["confidentiality","integrity","availability"]},"minItems":1,"description":"Art. 4(12) — breach of security leading to unauthorised disclosure, alteration, loss or access."},"root_cause_known":{"type":"boolean"},"root_cause":{"type":"string"},"delay_beyond_72h_reason":{"type":"string"}}},"data_affected":{"type":"object","required":["data_subjects_estimated","records_estimated","data_categories"],"additionalProperties":false,"properties":{"data_subjects_estimated":{"type":"integer","minimum":0},"data_subjects_notes":{"type":"string"},"records_estimated":{"type":"integer","minimum":0},"records_notes":{"type":"string"},"data_categories":{"type":"array","items":{"type":"string"},"minItems":1},"special_categories":{"type":"array","items":{"type":"string"}},"children_affected":{"type":"boolean"}}},"consequences":{"type":"string","description":"Art. 33(3)(c) — likely consequences of the personal data breach."},"measures":{"type":"object","required":["taken"],"additionalProperties":false,"properties":{"taken":{"type":"array","items":{"type":"string"}},"proposed":{"type":"array","items":{"type":"string"}},"mitigations_effects":{"type":"string"}}},"data_subject_notification":{"type":"object","additionalProperties":false,"properties":{"required":{"type":"boolean","description":"True if Art. 34 threshold (high risk) is met."},"sent_on":{"type":"string","format":"date"},"method":{"type":"string"},"not_required_reason":{"type":"string","description":"If Art. 34(3) exception applies."}}},"cross_border":{"type":"object","additionalProperties":false,"properties":{"lead_authority":{"type":"string"},"other_authorities_notified":{"type":"array","items":{"type":"string"}}}},"signatory":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string"},"title":{"type":"string"}}}}}