Data Subject Requests and Incidents

Yes. The system captures all relevant details of a data breach in a structured way, maps likelihood and severity in a graphical risk matrix, and automatically monitors the 72-hour notification obligation under Art. 33 GDPR. Nine ready-to-use report templates cover the initial, follow-up, and final report to the supervisory authority (Art. 33), the notification to the controller (Art. 33 para. 2), the notification of affected persons (Art. 34), and the reports to the BSI (Sections 25 and 32 BSIG). Via an embeddable web form, breach notices can be captured directly from the website or intranet.

Software for breach reporting should automatically monitor the 72-hour deadline under Art. 33 GDPR, support a structured risk assessment, and document all notifications in a revision-safe way. preeco | data protection delivers all of this: structured incident capture with categories and severity, a graphical risk matrix of likelihood and severity, automatic deadline monitoring with a clear notification-deadline status per report, and nine ready-to-use report templates – from the initial report to the supervisory authority (Art. 33) via the notification of affected persons (Art. 34) through to the reports to the BSI (Sections 25 and 32 BSIG).

You create a form in preeco | data protection and embed it in your website or intranet using HTML code. Incoming requests are recorded directly as data subject requests, and recipients you define are notified when one arrives. Asking for the postal address is optional. In the same way you can set up forms through which reports of possible personal data breaches are submitted.

You link the request to the processing activities concerned. preeco | data protection then shows the related data processing systems and data fields, so you know where to look. You send the response by email directly from the system, and the correspondence is documented on the request. Quick text modules for frequent answers can be used as templates.

You record the identity check of the data subject directly on the request, including the time at which you asked for proof. If you refuse a request, you select the reason: manifestly unfounded, excessive, identity not proven or other. Every request is assigned a request type, from access and erasure to withdrawal of consent, so it remains traceable later on.

For each notification, preeco | data protection derives the status from the deadline and the time of reporting: deadline running, reported on time, reported late, deadline missed or no deadline. If a deadline was missed, you document the reason directly on the notification. You and later auditors can see at a glance which notification went to the supervisory authority, the controller, the data subjects or the BSI, when, and with what result.

You classify the incident by category and severity, record measures in a hierarchical structure and capture lessons learned. Tasks are assigned to the people responsible, who are notified by email. Individual sections can optionally be completed or revised with AI, and you review the content yourself. Each approval creates a revision that you can compare with earlier versions.