· ReadyStack
Worked example
Real numbers from this tool, line by line.
You find out about a personal-data breach on a Friday at 18:30. A colleague says the payroll file went to the wrong client, or a sales laptop was left on a train. Under GDPR Article 33, and the same article in UK GDPR, the notice to the supervisory authority is due without undue delay and, where feasible, not later than 72 hours after you became aware. From Fri 2 Oct 2026 at 18:30, that is Mon 5 Oct 2026 at 18:30. 48 of those 72 hours fall on the weekend. The clock counts hours, not working days.
The clock starts when you are aware, meaning you have a reasonable degree of certainty that a security incident has compromised personal data (EDPB Guidelines 9/2022). If a processor, such as your newsletter vendor, finds the breach, Article 33(2) says it tells you without undue delay. Your 72 hours then start when its email reaches you. In one example on the board, a vendor report arrives Thu 24 Sep 2026 at 08:40, so the deadline is Sun 27 Sep 2026 at 08:40, a Sunday.
Missing the deadline costs money. Article 83(4)(a) allows fines up to €10,000,000 or 2% of worldwide annual turnover for breaching Articles 33 and 34. Under UK GDPR the standard maximum is £8,700,000 or 2%. In December 2020 the Irish Data Protection Commission fined Twitter €450,000 for a late notice and weak breach documentation.
Not every breach goes to the authority. If a breach is unlikely to result in a risk to people, you do not notify. You still have to write it down. Article 33(5) asks you to document any breach: the facts, its effects and what you did about it. That is the step people skip. A lost USB stick with 212 job applications, encrypted with the key kept elsewhere, is not notified, but it still needs a register row that gives the reason.
If the risk is high, a second duty applies. Article 34 says you tell the people affected without undue delay, in plain language, with a contact point, the likely consequences and the measures taken. A payroll spreadsheet with National Insurance numbers and bank details for 38 staff meets that test. An export of 1,240 customer names and order histories with no payment data usually leads to a notice to the authority, but no letter to customers.
Other clocks can run at the same time. NIS2 entities send an early warning within 24 hours, a notification within 72 hours and a final report within one month. Telecoms and internet access providers report every personal data breach within 24 hours, whatever the risk.
This Obsidian kanban template puts all of that on one board. Each breach is a note with a stage property, and the core Bases plugin shows five columns: 1 Detected, 2 Assessing, 3 Notify authority, 4 Tell people, 5 Closed. A Clock view lists every open card with its aware time and notify_by deadline. A register view shows every breach, whatever its column, with the fields Article 33(5) needs. A canvas gives you a wall view you can drag cards around on.
The vault has 21 files: 18 notes, 2 Bases and 1 canvas. That covers 7 rule notes, 4 templates (Breach card, Authority notice draft, Message to affected people, Post-incident review) and 6 filled examples. It needs no community plugins, only Templates, Bases and Canvas.
Try your own breach in the browser first. Enter the minute you became aware, UK or EU, the risk level and any parallel regime. You get the deadline, the weekend hours, and whether you must notify and tell people.
15 seconds — what it actually does
Questions people ask
What does this Obsidian kanban template do?
It turns every personal-data breach into a card on a five-column board in Obsidian: Detected, Assessing, Notify authority, Tell people, Closed. Each card carries the minute you became aware and the 72-hour notice deadline, and every card also shows up in the Article 33(5) breach register view, including breaches you decided not to notify.
Who is this breach board for?
Data protection leads, DPOs and founders at small and mid-size companies under EU GDPR or UK GDPR who already keep notes in Obsidian. It fits a team that gets a few incidents a year, such as misdirected emails, lost laptops or a processor reporting ransomware, and needs a register the ICO or an EU authority can read.
Why not use a free kanban template or a spreadsheet?
A free kanban template has columns but no law: it does not know that 72 hours count weekends, that a card with risk none must still stay in the Article 33(5) register, or that NIS2 and the telecoms 24-hour rule run as separate clocks. A spreadsheet has the register but no board, no notice draft and no worked examples.
What can I do for free?
In the browser you get the Article 33 clock for one breach: the authority deadline from the minute you became aware, how many hours fall on a weekend, whether to notify and whether to tell people. Example: aware Fri 2 Oct 2026 at 18:30 gives a notice due Mon 5 Oct 2026 at 18:30. The vault map and the Start here note are free to read.
How does $69.99 compare with what a missed notice can cost?
The vault is $69.99 once, not a subscription. GDPR Art. 83(4)(a) allows fines up to €10,000,000 or 2% of worldwide annual turnover for breaches of Articles 33 and 34; under UK GDPR the standard maximum is £8,700,000 or 2%. The Irish DPC fined Twitter €450,000 in December 2020 for a late notice and weak breach documentation.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.