AI tool breach put customers at risk? A GDPR Article 34 sheet for telling the people affected, for small businesses
What you get: a finished breach letter sheet in three tabs: a "must we tell people?" test with one row per breach and a result formula, a letter builder with the four things the message must contain, and a sent log with a status formula, plus AI tool examples and two made-up example rows.
Short answer: when a personal data breach is likely to result in a high risk to people, Article 34 GDPR says you must tell those people without undue delay, in clear and plain language. This is separate from the 72-hour report to the authority under Article 33. You can skip the letters only in three cases: the data was unreadable to outsiders (for example encrypted), later steps mean the high risk is no longer likely, or writing to everyone would take disproportionate effort, in which case you make a public notice instead.
Step 1: tab 1, must we tell the people affected? (one row per breach)
| Column | What to write | Source |
|---|---|---|
| A. Breach | "chatbot transcripts visible to other users", "AI note-taker shared a client call link publicly", "staff pasted a customer list into a public AI tool" | Art. 4(12) |
| B. We became aware on | Date and time | Art. 33(1) |
| C. High risk to people likely? | Yes or No, with one line on why: health data, ID or bank details, passwords, children, data that could lead to fraud, discrimination or embarrassment | Art. 34(1), Recital 86 |
| D. Data unreadable to outsiders? | Yes only if the affected data was protected, for example encrypted, and the key was not taken | Art. 34(3)(a) |
| E. Later steps removed the high risk? | Yes only if what you did afterwards means the high risk is no longer likely to happen. Write what you did | Art. 34(3)(b) |
| F. Writing to each person is disproportionate? | Yes if you cannot reasonably reach people one by one, for example no contact details | Art. 34(3)(c) |
| G. Result | =IF(C2<>"Yes","No letters needed: still log it and check the 72-hour report",IF(OR(D2="Yes",E2="Yes"),"Letters may not be needed: write down why",IF(F2="Yes","Public notice instead of letters","Tell each person now: fill tab 2"))) | Art. 34(1), (3); our working rule |
The formula is a first sort, not a legal conclusion. Your supervisory authority can still require you to tell people, or decide that one of the three exceptions applies (Article 34(4)). Keep column C's reasons, because Article 33(5) asks you to document every breach, its effects and what you did.
Step 2: tab 2, the letter builder
Article 34(2) says the message must describe the breach in clear and plain language and contain at least the items in Article 33(3)(b), (c) and (d). Recital 86 adds recommendations so people can protect themselves.
| Row | What to write | Source |
|---|---|---|
| 1. What happened | In plain words: what data, when, how it was exposed. "On 20 October our website chatbot showed parts of other customers' chats to some visitors for about two hours." | Art. 34(2) |
| 2. Who to contact | Name and contact details of your data protection officer, or another contact point | Art. 33(3)(b) |
| 3. Likely consequences | "Someone may have read your order number and delivery address." | Art. 33(3)(c) |
| 4. What we did and will do | "We switched the chatbot off, deleted the stored transcripts at the supplier and changed its settings." | Art. 33(3)(d) |
| 5. What you can do | "Be careful with emails or calls that mention your order; we will never ask for your card details." | Recital 86 |
| 6. Joined-up text | ="Dear customer, "&B1&" "&B3&" "&B4&" "&B5&" Questions: "&B2 | our working rule |
Put the answers in column B of rows 1 to 5; row 6 joins them. Read the result aloud: if a customer would need a lawyer to understand it, rewrite it.
Step 3: tab 3, the sent log (one row per group of people)
| Column | What to write | Source |
|---|---|---|
| A. Breach | Same name as tab 1 | Art. 33(5) |
| B. Group | "412 chatbot users with an email address", "about 60 visitors with no contact details" | Art. 34(1) |
| C. How we told them | Email, letter, SMS, or for F = Yes in tab 1 a notice on the website and social channels | Art. 34(3)(c) |
| D. Sent on | Date, or blank | Art. 34(1) |
| E. Days since aware | =IF(D2="",TODAY(),D2)-INT(VLOOKUP(A2,'Test'!A:B,2,FALSE)) | Art. 34(1) |
| F. Status | =IF(D2<>"","Sent: keep a copy",IF(E2>=3,"Late: send today and note the reason","Draft and send without undue delay")) | Art. 34(1); the 3-day flag is our working rule |
Name tab 1 Test; the formula in E assumes that layout. Article 34 sets no fixed number of days. "Without undue delay" is the test, and Recital 86 says an immediate risk of harm calls for prompt communication.
Where AI tools cause breaches small businesses must tell people about
- A chatbot or AI help desk that shows one customer's conversation to another
- An AI meeting note-taker that sends a transcript with health, money or HR details to the wrong people: see the note-taker setup sheet
- Staff pasting customer lists into a public AI tool whose terms let the supplier reuse inputs: see the staff AI use policy
- A shared AI tool account with a weak password that someone else gets into: see the AI account access sheet
Two example rows (made-up businesses, for illustration only)
Example 1, a physiotherapy clinic whose AI booking chatbot exposed appointment reasons: tab 1: C. Yes (health data) · D. No · E. No · F. No · G. Tell each person now: fill tab 2. Tab 3: group "38 patients who used the chatbot on 20 Oct" · email · sent 21 Oct · status Sent: keep a copy.
Example 2, an online shop whose encrypted AI export file was taken from a supplier: tab 1: C. Yes · D. Yes (file encrypted, key not taken) · G. Letters may not be needed: write down why. The shop records the reason and still checks the 72-hour report to the authority.
Do this week
- Copy the three tabs into your incident folder before you need them
- Write rows 2 and 5 of tab 2 now: your contact point and your standard advice
- Pair it with the 72-hour breach sheet for the report to the authority
- Ask each AI supplier how fast it will tell you about a breach (Article 33(2) says without undue delay): see the processor agreement check
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4, 33 and 34 and Recital 86, as published on gdpr-info.eu). The result formulas, the letter layout and the 3-day flag are our own working rules; the law says "without undue delay" and sets no day count. Authorities may take a stricter view, so check your data protection authority's guidance. Example rows are made up for illustration and do not describe any real business. Checked on 26 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clinics, shops and agencies among your clients increasingly run chatbots and note-takers. Hand them tab 1 with the client AI inventory, stay inside your professional rules and refer legal questions on.
Keep breach-prone AI tools in your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Mark each AI tool that holds customer data, and attach this sheet as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: 72-hour breach sheet · AI incident and complaint log · Article 19 recipient notices · Article 32 access security
Sources
- Article 34 GDPR, Communication of a personal data breach to the data subject (with Article 33 and Recital 86); official text: Regulation (EU) 2016/679
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.