Data Breach Severity Calculator

Estimate data breach severity

When a personal data breach occurs, assessing its severity guides how to respond and whether it must be reported. This calculator uses the methodology published by ENISA, the European agency, which computes a severity score from three factors: the data processing context, reflecting how sensitive the data is; the ease of identification, how easily individuals can be identified from the breached data; and the circumstances of the breach, such as whether confidentiality, integrity or availability were affected and whether it was malicious.

The score is the data processing context multiplied by the ease of identification, plus the circumstances factor, and it maps to severity levels from low to very high.

Responding to breaches

Breach severity informs the critical decisions after an incident: whether to notify the supervisory authority within seventy-two hours, as the GDPR requires for breaches likely to risk individuals rights, and whether to inform the affected individuals. A structured, repeatable scoring method supports consistent, defensible decisions and documentation. Higher severity generally means a stronger case for notification and more urgent remediation.

This is a structured estimate to support your assessment, not a substitute for a full evaluation of the specific circumstances and legal obligations. All calculation happens locally in your browser.

Related tools

• SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
• Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
• Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
• Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.