Recital 39

In the case of a data breach that is not likely to result in a high risk to the rights and freedoms of natural persons, the controller should not be required to notify the competent supervisory authority. The higher threshold for notifying a data breach to the supervisory authority does not affect the obligation of the controller to document the breach in accordance with paragraph 5 of Article 33 of Regulation (EU) 2016/679, or its obligation to be able to demonstrate its compliance with that Regulation, in accordance with Article 5(2) of that Regulation. In order to facilitate compliance by controllers and a harmonised approach in the Union, the Board should establish and make public a common template for notifying data breaches to the competent supervisory authority and a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person, and a common list of circumstances in which a personal data breach does not result in such a high risk . In order to take account of new information security threats, the common template and the list should be reviewed at least every three years and updated where necessary. The Commission may adopt, by means of an implementing act, the common template as established by the Board, as well as its updates where necessary. The lack of a common list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person should not affect the obligations of controllers to notify those breaches. The alignment of notification thresholds should not affect the controller’s obligation to carry out an individual risk assessment and to maintain complete documentation of personal data breaches in accordance with Article 33(5) of Regulation (EU) 2016/679. The common lists of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedom of a natural person and in which a personal data breach is not likely to result in a high risk should also apply in order to determine when communicating the data breaches to the data subject, in accordance with Article 34.