Breach Notification Completeness

Check a breach report against NDPA 2023 Section 40 and NDPC GAID 2025 Article 33 — mandated content, the 72-hour deadline, and the data-subject communication duty

What this covers

NDPA 2023 Section 40(2) requires a data controller to notify the NDPC within 72 hoursof becoming aware of a personal data breach that is likely to result in a risk to data subjects' rights and freedoms. NDPC GAID 2025 Article 33(5) then enumerates the content that notification must include, and Section 40(3) adds a duty to communicate the breach to affected data subjects — in plain, clear language — where the risk is high.

assessBreachNotification() checks a BreachReport against those requirements: which mandated items are present, whether the 72-hour window is still open, and whether a data-subject communication is owed. It is a pure function with no React dependency, and ships as the useBreachNotificationAssessment hook for client UIs.

A completeness aid, not legal advice

The checker verifies that your breach record contains the information the NDPC expects and tracks the statutory clock. It does not decide whether a breach is notifiable or replace your DPO's judgement — verify against current NDPC guidance.

Using assessBreachNotification()

import { assessBreachNotification } from '@tantainnovative/ndpr-toolkit/core';

const result = assessBreachNotification(breachReport, {
  asOf: Date.now(),
  assessment: riskAssessment,   // optional — high risk triggers the S.40(3) duty
  notification: regulatoryNotification, // optional — judges timeliness against sentAt
});

result.complete;                 // false until every mandated item is present
result.completeness;             // 0–100 across applicable items
result.missing;                  // labels of unsatisfied items
result.recommendations;          // actionable steps, each citing its provision

The content checklist

result.notificationToCommission is an array of items, each with an id, a label, the section it derives from, and whether it is satisfied:

Item	Source	BreachReport field
Circumstances of the breach	GAID 2025 Art. 33(5)(a)	`description`
Date / time period	GAID 2025 Art. 33(5)(b)	`occurredAt`
Personal data involved	GAID 2025 Art. 33(5)(c)	`dataTypes`
Risk of harm	GAID 2025 Art. 33(5)(d)	`likelyConsequences`
Number at risk	GAID 2025 Art. 33(5)(e)	`estimatedAffectedSubjects`
Steps to reduce harm	GAID 2025 Art. 33(5)(f)	`mitigationMeasures`
Steps to notify subjects	GAID 2025 Art. 33(5)(g)	`initialActions`
Contact point	GAID 2025 Art. 33(5)(h)	`dpoContact`
Categories of data subjects	NDPA S. 40(2)	`dataSubjectCategories`
Approximate record count	NDPA S. 40(2)	`approximateRecordCount`

The 72-hour clock

result.timing tracks the statutory window from discoveredAt:

result.timing.deadline;                   // discoveredAt + 72h
result.timing.hoursRemaining;             // time left (negative once overdue)
result.timing.overdue;                    // true once the window has passed
result.timing.notified;                   // whether a notification was recorded
result.timing.requiresDelayJustification; // late filings must state the reason

Pass deadlineHoursto override the window. Where complete details aren't available within 72 hours, the NDPC permits phased reporting — the checker surfaces this in its recommendations rather than treating the filing as failed.

High-risk: communicating to data subjects

When the risk is high — set explicitly via { highRisk: true } or derived from assessment.highRisksToRightsAndFreedoms — dataSubjectCommunicationRequired becomes true and a second checklist (dataSubjectCommunication) covers the Section 40(3) communication: nature and context, likely consequences, safeguards and measures, and a contact point — all in plain, clear language. These items count toward complete and completeness when required.