Personal data breach notification procedure

Last updated: 12 April 2026

Do you suspect a breach involving your data?

Contact our DPO immediately: dpo@pickledeck.com or +33 6 24 37 93 07. You can also use our dedicated form /securite/disclosure.

1. Purpose

This procedure formalises PickleDeck's commitment to notifying personal data breaches, in accordance with Articles 33 and 34 of the GDPR and the EDPB guidelines WP 250 rev. 01.

2. Detection sources

A breach can be detected through several channels:

Automatic monitoring alerts (Supabase, Vercel)
Report by an internal staff member
Report by a user via the /securite/disclosure form
Notification received from a subprocessor (Stripe, Resend, etc.)
Detection through analysis of security & audit logs (kept for 1 year)

3. Assessment criteria

Each breach detected undergoes a structured assessment:

Nature	Confidentiality, integrity or availability of the data
Categories	Data concerned (identifying, sensitive, minors, financial...)
Volume	Number of people affected
Severity	Potential consequences for the data subjects
Existing measures	Encryption, anonymisation, access controls in place reducing the risk

4. Risk classification

The assessment results in a classification into 3 levels:

Low

Criterion: Non-sensitive data, limited volume, minor consequences

Action: Internal documentation, corrective measures, no CNIL notification

Medium

Criterion: Identifying data or significant volume, possible but limited consequences

Action: CNIL notification within 72h via its online service, no communication to individuals

High

Criterion: Sensitive data (health, financial, minors), large volume, serious consequences

Action: CNIL notification within 72h + communication without delay to the data subjects (Art. 34)

5. Notification to the CNIL

Notification to the CNIL is made via its official online service:

notifications.cnil.fr

Deadline: 72 hours after becoming aware of the breach
Partial notification permitted by Art. 33.4 if the complete information is not available within 72h: what is known is notified and completed as information becomes available

6. Communication to data subjects (Art. 34)

When the risk is classified as high, the data subjects are informed without undue delay. The communication contains:

A clear description of the nature of the breach
The DPO's contact details (dpo@pickledeck.com, +33 6 24 37 93 07)
The likely consequences of the breach
The measures taken or proposed to mitigate the effects

Exceptions to individual communication (Art. 34.3):

Encrypted data making access unintelligible to third parties
Subsequent measures ensuring the risk is no longer likely to materialise
Disproportionate effort given the volume → public communication instead (dedicated page + email to known public contacts)

7. Internal documentation (Art. 33.5)

All breaches are documented in an internal register, even those that do not trigger a CNIL notification. This register contains the facts, the effects and the corrective measures taken. This documentation is mandatory under Art. 33.5.

8. Corrective measures

Immediate isolation of the compromised component
Revocation of tokens and rotation of potentially exposed secrets
Application of the necessary fixes (patch, configuration, RLS)
Documented post-mortem with prevention actions

9. Retention

The internal breach register is kept for 5 years after the incident is resolved, in line with CNIL recommendations.

References cited: GDPR Art. 33, Art. 34, Art. 33.4, Art. 33.5, Art. 34.3, EDPB guidelines WP 250 rev. 01.