Work out pii record exposure instantly with clear inputs, formula shown and shareable results.
Regulatory obligations are counted in data subjects, not rows, so a dataset with several records per person overstates the notification population. What drives severity is the field mix: a record with two or more direct identifiers such as name plus national ID is immediately identifying, while quasi-identifiers alone may still re-identify when combined, which is the basis of k-anonymity analysis.
Exposure scope
data subjects = records x distinct-subject share; data points = records x personal fields per record
Only when the breach is likely to result in a high risk to their rights and freedoms. The supervisory authority must be notified within 72 hours regardless, where the risk is more than negligible.
Strong encryption with keys not compromised is explicitly recognised as a mitigating factor and commonly removes the duty to notify individuals, though the assessment must still be documented.