This procedure ensures that personal data breaches are detected, reported, categorised and monitored, incidents are assessed and responded to appropriately without undue delay, and decisive actions are taken to reduce the impact of a data breach. It also outlines the activities for reporting data breaches to the supervisory authority and affected data subjects.