Every time the institution misses a statutory deadline or their response reveals a regulatory failure, the system records it as a GDPR breach. You don't need to track this; it happens automatically. Each breach is then cited with the specific article and date in your future letters.
The more breaches that accumulate, the stronger your case becomes, particularly for ICO complaints and Financial Ombudsman referrals.
What gets recorded
The system records breaches against specific UK GDPR articles:
- Article 15 (Right of Access): when the institution fails to respond to a Subject Access Request within the statutory timeframe, or provides an incomplete or improperly redacted response
- Article 16 (Right to Rectification): when the institution fails to correct inaccurate data or address your rectification request
- Article 17 (Right to Erasure): when the institution fails to respond to an erasure request or refuses without valid grounds
- Article 21 (Right to Object): when the institution fails to respond to a GDPR challenge or objection within the statutory timeframe
Each breach is recorded with the specific article violated, the type of failure, a description, and, when extracted from their response, a direct quote proving the breach.
How breaches are detected
Breaches are recorded automatically through two mechanisms:
Deadline monitoring
The system continuously monitors statutory deadlines for every letter you've sent. If the institution hasn't responded within the required timeframe:
- Subject Access Requests: one-month deadline under Articles 12A and 15. If no response, a breach is recorded automatically.
- GDPR challenges (Article 21): one-month deadline. If no response, a breach is recorded automatically.
You don't track these deadlines. The system monitors them and records breaches the moment they expire.
Response analysis
When you upload an institution response, the system analyses the response for GDPR violations. Breaches detected this way include:
- Incomplete SAR responses: data missing, time periods excluded, documents referenced but not provided
- Unjustified redactions: information redacted without citing a valid exemption
- No legitimate interest assessment: the institution processed your data under legitimate interests but can't demonstrate they conducted a proper assessment
- Missing required statements: failure to provide information they're legally required to include
Each breach is extracted from the institution's own words, including the direct quote that proves the violation.
Duplicate breaches are prevented automatically. The same violation won't be recorded twice. But different breaches of the same article are recorded separately: for example, two different Article 15 failures from two different responses each get their own record.
How breaches are used in your letters
Every breach on record is available to the system when generating your letters. The system doesn't make vague threats; it cites specific violations:
- Counter responses: breaches are cited to demonstrate a pattern of non-compliance, strengthening the demand for marker removal.
- ICO complaint letters: each documented breach is listed with the article, date, and description. This gives the ICO a clear, evidenced basis for investigation.
- FOS referral letters: accumulated breaches are presented as part of the full complaint history.
- Escalation leverage: even before an ICO complaint is filed, the system references documented breaches as a credible escalation threat.
The system instructs letters to cite specific breaches rather than making general statements about non-compliance. "You failed to respond to my Subject Access Request of 14 March within one calendar month, in breach of UK GDPR Articles 12A and 15" is more powerful than "you haven't complied with GDPR".
Breaches and escalation
Documented GDPR breaches directly influence your escalation path:
- ICO referral becomes viable: an ICO complaint requires documented evidence of GDPR non-compliance. Accumulated breach records provide exactly that.
- The case strengthens over time: each breach adds to the body of evidence. A case with five documented breaches is significantly stronger than one with none.
- The institution sees the pattern building: each letter references previous breaches. The institution can see the escalation trajectory and knows an ICO complaint is becoming increasingly justified.
Breaches accumulate with no limit
There's no cap on how many breaches can be recorded per case. Every missed deadline, every incomplete response, every regulatory failure: each one is logged and available for citation. Cases that involve multiple rounds of correspondence can accumulate substantial breach records, particularly if the institution is slow to respond or provides incomplete SAR data.
This is by design. The longer the institution delays or deflects, the more documented violations they accumulate, and the stronger your position becomes.
What you need to do
Nothing. Breach recording is fully automatic:
- Deadlines are monitored continuously: you don't track them
- Response violations are detected during analysis: you just upload the response
- Breaches are cited in letters automatically: you don't need to reference them yourself
- Escalation decisions account for breaches: the system factors them in when determining your next step
