Data Breach Severity Calculator
Assess the severity of a data breach by answering questions about the data type, volume, affected individuals, and likelihood of harm — and determine whether regulatory notification is required.
Tool details
About this tool
Answer a short set of questions about the data types, affected individuals and likely harm, and the calculator classifies the breach severity and tells you which notifications are mandatory.
What you'll get
- A severity band (Low / Material / High / Critical).
- A notification matrix per regulation (GDPR 72-hour, PDPA 3-day, DPDP without-delay, UAE PDPL as set by Executive Regulations).
- A pre-filled regulator notification template you can edit and send.
How it works
- Severity is a function of data type (basic, sensitive, special category), volume (count of affected individuals), likelihood of harm (identity theft, discrimination, physical safety) and whether the data was already published.
- Each regulation has its own notification threshold — the calculator shows which thresholds are crossed and the clock on each.
- No data leaves your browser; this is a self-help triage tool, not a filing system.
Based on
- ENISA Severity Methodology for Personal Data Breaches v1.1.
- GDPR Articles 33 and 34, EDPB Guidelines 9/2022.
- PDPC advisory guidelines on mandatory data breach notification.
- DPDP Act § 8(6) + DPDP Rules 2025 on breach reporting.
Frequently asked questions
What's the GDPR notification clock?+
72 hours from the moment the controller becomes aware the breach is reasonably likely to result in a risk to data subjects. 'Awareness' is a judgment call — document it with a timestamp either way.
Does PDPA's 3-day clock start the same way?+
The clock starts when the organisation assesses that the breach is notifiable (significant harm or 500+ individuals). Document the assessment timestamp — the PDPC asks for it.
What counts as 'likely to cause significant harm' under PDPA?+
The PDPC lists prescribed data types in the regulations (ICs, biometric, financial, health, insurance details). Any breach of these is treated as significant unless rebutted; otherwise the harm assessment is case-by-case.
What about the UAE PDPL?+
The Decree-Law requires notification 'without undue delay'. The Executive Regulations will set a hard timing (expected to align with 72 hours). Document notification the way you would under GDPR today; swap to the ER-specific form when it publishes.
Need more than a free tool?
TruePrivacy is a full privacy operations platform. Automate DSRs, consent, vendor risk, and breach response.
Free 14-day trial · No credit card required · Setup in minutes