Is it possible to report an incomplete breach to PUODO and subsequently forward further information to PUODO regarding the report?
ANSWER
Yes, the controller may spread the submission of information relating to the breach to the supervisory authority over time. This is expressly stated in Article 33(4) GDPR. However, it is essential that the so-called initial notification is made within 72 hours (tick box in point 1 of the breach notification form, in row no. 3 of column no. 2).
This can be done when we do not possess all the information necessary to submit the initial notification (complete the entire notification form). This is also confirmed by the President of PUODO in the guide "Controller obligations related to personal data breaches" (https://uodo.gov.pl/pl/134/1029 – p. 10 of the document) and by the Article 29 Working Party in its guidelines WP 250 (https://www.uodo.gov.pl/pl/10/12 – pp. 17–18 of the document).
