Under GDPR Article 33, a controller must notify its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. The exception is a breach unlikely to risk people's rights and freedoms. A late notice must explain the delay.
What the text actually says
The 72 hours run from when the controller becomes aware, not from when the breach happened. The article does not define "aware" in the paragraph itself, so write down in your response plan who decides that a security event is a personal data breach, and log the time they decide it.
Two details are easy to miss. First, if you do not have all the facts yet, you may provide information in phases without further undue delay. A short, honest first notice beats a perfect one that arrives on day five. Second, the controller must document every breach, including the facts, its effects and the remedial action, whether or not it was reported. That record must let the authority verify your compliance.
What the notice must contain
Article 33(3) lists four items:
- The nature of the breach, with the approximate number and categories of people and records where possible.
- The name and contact details of your data protection officer or another contact point.
- The likely consequences of the breach.
- The measures taken or proposed, including steps to limit harm.
Prepare a one page template with these four headings before you need it. During an incident nobody wants to read an article to work out what to write.
When you may not need to notify
If the breach is unlikely to result in a risk to people's rights and freedoms, no notification to the authority is needed. That is a judgment call, so record the reasoning. A lost laptop with full disk encryption and a key that was not exposed is a different situation from a database export in a public bucket.
Notifying the authority is separate from telling the individuals affected. That second duty has its own threshold, covered in our post on telling individuals about a breach.
What processors owe the controller
A processor must notify the controller without undue delay after becoming aware of a breach. The 72 hours belong to the controller, so a processor that sits on news for three days can use up most of its customer's window. If you are a processor, put a short notice period in your contracts and test it.
A practical 72 hour timeline
- Hour 0: log the time a person with authority confirms that personal data is involved.
- Hours 0 to 12: contain, preserve logs, name an incident lead.
- Hours 12 to 48: scope which data, which people, which countries, and decide on risk.
- Hours 48 to 72: file the notice, in phases if needed, and record the decision.
Adjust the numbers to your own size. The point is that the decision about risk is made by a named person and written down.
Quick check
Does the 72 hours include weekends?
The article counts hours from awareness and makes no exception for weekends, so plan for out of hours cover.
Can we wait until the investigation finishes?
No. The text allows information to be provided in phases, so file what you know and update later.
If you want help keeping incident evidence and policies in one place, Safeguard offers compliance and evidence automation. It supports your process and does not replace legal advice.
Sources
Last reviewed: 19 October 2026.
