Draft · INC-20261112-C810 · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

3 items to complete — the record does not hold categories and approximate number of data subjects and of records; the likely consequences for the people concerned; the measures taken or proposed. Each is marked [to complete: …] in the text.

Notification to the supervisory authority — INC-20261112-C810 — Support ticket export sent to the wrong customer

DRAFT: Notification to the supervisory authority under GDPR — personal data breach
Regulation (EU) 2016/679, Article 33, Article 33(1).
Prepared by Cyresora from incident INC-20261112-C810. Yours to check and edit before you send it; Cyresora files nothing.

To: Data protection supervisory authority

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Support ticket export sent to the wrong customer
Our reference: INC-20261112-C810
Became aware: 2026-11-12 04:37:02 UTC (2026-11-12 05:37 CET)
Severity (our assessment): medium

3. Became aware of the personal data breach (Article 33(1))
2026-11-12 10:37:02 UTC (2026-11-12 11:37 CET)

4. Nature of the breach, categories and approximate number of people and of records concerned (Article 33(3)(a))
A scheduled export of support tickets, holding the names, email addresses and phone numbers of 214 contacts at one customer, was emailed to a different customer. The recipient has confirmed deletion in writing.
[to complete: categories and approximate number of data subjects and of records]

5. Data protection officer or other contact point (Article 33(3)(b))
security@kestrel.example

6. Likely consequences (Article 33(3)(c))
[to complete: the likely consequences for the people concerned]

7. Measures taken or proposed, including to mitigate possible adverse effects (Article 33(3)(d))
[to complete: the measures taken or proposed]

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock and starts the next one from the moment you enter.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Notification to the supervisory authority

Notification to the supervisory authority — INC-20261112-C810 — Support ticket export sent to the wrong customer

When you have sent it