GDPR Article 33: the 72 hour breach clock, explained for engineers

GDPR Article 33 says a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk people's rights and freedoms. Processors must tell the controller without undue delay. This is educational, not legal advice.

When the clock starts

The text says "after having become aware of it". It does not say after the investigation ends. That wording is why teams build triage steps that produce a clear "we are now aware" moment, recorded with a timestamp, instead of leaving it fuzzy.

If the 72 hours pass, the notification still has to be made and must explain the reasons for the delay.

What the notification must contain

Article 33(3) sets a minimum. The notice has to:

• describe the nature of the breach, including where possible the categories and approximate numbers of people and records affected
• give the name and contact details of the data protection officer or another contact point
• describe the likely consequences
• describe the measures taken or proposed to deal with it, including steps to reduce harm

Article 33(4) allows information to be provided in phases without undue further delay. In practice that means you can file early with what you know and add detail later. A first notice with gaps is better than silence while you finish forensics.

The documentation duty most teams forget

Article 33(5) requires the controller to document every personal data breach, with the facts, the effects and the remedial action. This applies even to breaches you decide not to notify. The record must let the authority verify compliance.

So a "no notification needed" call needs a written reason. Keep the reasoning: what data, who could see it, why the risk was judged unlikely.

What to build before you need it

An engineering team can prepare four things.

1. A way to flag a suspected personal data incident that routes straight to the privacy lead, day or night.
2. A short form that captures the Article 33(3) items as they become known.
3. Logging good enough to tell what was accessed. Without it you cannot estimate numbers or categories.
4. A vendor channel. If you are a controller and a processor has an incident, you need them to tell you fast. Put a notice deadline in the contract.

Common mistakes

Waiting for certainty. Phased reporting exists for this reason.

Counting only working days. The rule says hours.

Assuming a vendor's problem is not yours. If you are the controller, the clock runs from your awareness.

Quick check

Sources

• GDPR Article 33 text

Last reviewed: 19 October 2026.