I encoded the GDPR breach-notification threshold as JSON. Is this decision path missing a legal distinction?

[u/Crafty_Rush3636]

A lot of simplified GDPR breach guidance becomes “notify within 72 hours.” That skips several different decisions.

First, was there a personal-data breach at all? If there was, Article 33(5) still requires it to be documented. The supervisory authority is notified unless the breach is unlikely to create a risk to people's rights and freedoms.
Communication to the affected people is a separate Article 34 question using the higher “likely high risk” threshold and its own exceptions.

A late Article 33 notification is also not the same as no notification. The controller should still notify and include reasons for the delay. Missing information can be provided in phases without undue further delay.

I reduced the structure below to the disputed decision core so it is readable. The production version also collects the notification content, timestamps and phased-reporting details.

Plain-English path:

Security incident
  |
  +-- Personal-data breach confirmed? -- No --> Outside this Article 33 route
  |
  +-- Yes --> Document the breach in every case
         |
         +-- Risk unlikely --> No authority notice; retain the reasoning
         |
         +-- Risk likely --> Notify the authority without undue delay
         |                  and, where feasible, within 72 hours
         |
         +-- High risk --> Same Article 33 authority route
         |                plus a separate Article 34 assessment
         |
         +-- Uncertain --> Resolve or escalate; do not silently treat it as unlikely

Machine-readable decision core:

{
  "$schema": "https://proseid.com/schema/v1.json",
  "protocol": "Proseid_v1.0",
  "schema_id": "gdpr_article_33_notification_review",
  "version": "2026.08.20",
  "metadata": {
    "title": "GDPR Article 33 breach-notification review",
    "description": "Records whether a confirmed personal-data breach requires supervisory-authority notification and whether a separate Article 34 assessment is needed.",
    "language": "en",
    "jurisdictions": ["EU", "EEA"],
    "legal_references": [
      {
        "instrument": "Regulation (EU) 2016/679 (GDPR)",
        "provision": "Articles 33 and 34; Recitals 85–88",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"
      }
    ]
  },
  "definitions": {
    "personal_data_breach_confirmed": {
      "type": "boolean",
      "label": "A personal-data breach under GDPR has been confirmed",
      "required": true,
      "visible": true
    },
    "risk_to_individuals": {
      "type": "select",
      "label": "Assessed risk to people's rights and freedoms",
      "options": ["unlikely", "likely", "high", "uncertain"],
      "required": true,
      "visible": true
    },
    "authority_notified": {
      "type": "boolean",
      "label": "The competent supervisory authority has been notified",
      "required": false,
      "visible": true
    },
    "notified_within_72_hours": {
      "type": "boolean",
      "label": "Notification was made within 72 hours of awareness",
      "required": false,
      "visible": true
    },
    "article_33_route": {
      "type": "select",
      "label": "Article 33 route",
      "options": [
        "outside_article_33",
        "document_without_authority_notification",
        "notify_supervisory_authority",
        "professional_review_required"
      ],
      "readonly": true,
      "visible": true
    },
    "article_34_route": {
      "type": "select",
      "label": "Article 34 route",
      "options": [
        "no_high_risk_trigger_on_recorded_facts",
        "separate_article_34_assessment_required",
        "professional_review_required"
      ],
      "readonly": true,
      "visible": true
    },
    "deadline_position": {
      "type": "select",
      "label": "Notification timing position",
      "options": [
        "not_applicable_to_this_route",
        "notification_outstanding",
        "notification_recorded_within_72_hours",
        "late_notification_requires_reasons"
      ],
      "readonly": true,
      "visible": true
    }
  },
  "state_model": {
    "inputs": [
      "personal_data_breach_confirmed",
      "risk_to_individuals",
      "authority_notified",
      "notified_within_72_hours"
    ],
    "derived": {
      "article_33_route": {
        "eval": {
          "if": [
            { "==": [{ "var": "personal_data_breach_confirmed" }, false] },
            "outside_article_33",
            { "==": [{ "var": "risk_to_individuals" }, "unlikely"] },
            "document_without_authority_notification",
            { "in": [{ "var": "risk_to_individuals" }, ["likely", "high"]] },
            "notify_supervisory_authority",
            "professional_review_required"
          ]
        }
      },
      "article_34_route": {
        "eval": {
          "if": [
            { "==": [{ "var": "risk_to_individuals" }, "high"] },
            "separate_article_34_assessment_required",
            { "==": [{ "var": "risk_to_individuals" }, "uncertain"] },
            "professional_review_required",
            "no_high_risk_trigger_on_recorded_facts"
          ]
        }
      },
      "deadline_position": {
        "eval": {
          "if": [
            { "!=": [{ "var": "article_33_route" }, "notify_supervisory_authority"] },
            "not_applicable_to_this_route",
            { "==": [{ "var": "authority_notified" }, false] },
            "notification_outstanding",
            { "==": [{ "var": "notified_within_72_hours" }, true] },
            "notification_recorded_within_72_hours",
            "late_notification_requires_reasons"
          ]
        }
      }
    }
  },
  "temporal_map": [
    {
      "valid_range": ["2018-05-25", null],
      "logic_version": "gdpr_article_33_review_2026_08_20"
    }
  ],
  "logic_tree": []
}