> For the complete documentation index, see [llms.txt](https://doc.dastra.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.dastra.eu/en/features/notifier-les-violations-de-donnees/incidents-as-data-processor.md). # Incidents as a Data Processor Dastra's data breach module adapts to your **organisation's role** in the incident: Data Controller (DC) or Data Processor (DP). This role determines the applicable obligations and which steps are displayed in the form. *** ## Declaring your role at creation When creating a new incident, a selector lets you choose between: * **Data Controller** — standard flow: supervisory authority notification, communication to data subjects, risk analysis. * **Data Processor** — adapted flow: the obligation to notify the supervisory authority directly does not apply; it is the Data Controller's responsibility to notify.
Create incident dialog with the Data Processor selector (Yes/No)

When creating an incident, indicate whether your organisation acts as a Data Processor

{% hint style="info" %} **Regulatory basis — GDPR Art. 33(2)** The Data Processor is required to notify any personal data breach to the Data Controller **without undue delay** after becoming aware of it. There is no obligation for the Processor to notify the supervisory authority directly — that obligation rests with the Data Controller. {% endhint %} *** ## Form differences in Data Processor mode When the **Data Processor** role is selected: | Element | DC mode | DP mode | | ------------------------------------------------ | ------------- | ---------------------------------- | | Supervisory authority notification step | ✅ Shown | ❌ Hidden | | Communication to data subjects section | Standard | Replaced by DP section (see below) | | Communication to Data Controller clients section | ❌ Not present | ✅ Present | *** ## Communication to Data Controller clients In Data Processor mode, a dedicated section replaces the standard communication section. It allows you to: * **Associate the Data Controller clients** involved in the incident — the list can be automatically synchronised from the processing activities linked to the incident * **Track the notification status** of each DC (notified / pending) * **Export the list** of involved DCs for your compliance file
Communication to Data Controllers section in a Data Processor incident

The Data Controllers tab lists the DCs to notify, with the Attach, Sync, and Export buttons

### Automatic synchronisation of DCs from linked processing activities If processing activities are associated with the incident, Dastra can automatically identify the relevant Data Controller clients from those activities and add them to the notification list. Click **Sync Data Controllers** in the dedicated section to trigger this synchronisation. *** ## Best practices * Notify your DC clients **without undue delay** as soon as you become aware of the incident — the GDPR does not set a fixed deadline for the Processor's notification to the Controller (unlike the 72-hour deadline imposed on Controllers towards the supervisory authority), but prompt action is essential. * Document the date and time of each notification sent to DCs in the dedicated section. * Keep a record of acknowledgements or responses from DCs in the incident attachments. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://doc.dastra.eu/en/features/notifier-les-violations-de-donnees/incidents-as-data-processor.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.