What happens when a breach occurs, and why the register matters at that moment.
Article 77
What it asks for
Anyone may complain to an authority in their country, and the authority must tell them the outcome.
For example
An unanswered access request becomes a complaint, and the authority asks the company for its side.
How Prudence covers it
The request log shows when the request arrived, what was done and when, which is what the authority asks for first.
Article 82
What it asks for
A person who suffers damage may claim compensation. A controller is liable unless it proves it was not responsible, and a processor is liable for breaches of its own duties.
For example
Proving it was not responsible needs contemporaneous evidence, not a reconstruction after the claim.
How Prudence covers it
The unalterable history against every record exists for this moment: who changed what, and when.
Article 83
What it asks for
Fines reach twenty million euro or four per cent of worldwide annual turnover, whichever is higher. Authorities take account of cooperation, the measures in place and the records kept.
For example
Two companies with the same incident are treated differently where one can show a maintained record and a working process.
How Prudence covers it
Prudence does not reduce a fine. It produces the evidence the authority weighs under Article 83(2), which is the part within an organisation's control.
Also in this part of the regulation