Under Article 33 of the GDPR, a controller must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Notification is not required if the breach is unlikely to result in a risk to individuals' rights and freedoms.
When the clock starts
The text says the 72 hours run from when the controller becomes aware of the breach. It does not say from when the breach happened. Decide internally what "aware" means for your team, and record the time you reached it. Your incident declaration rule matters here. See what an incident response plan needs.
What the notification must contain
At a minimum, Article 33 requires:
- the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned
- the name and contact details of the data protection officer or another contact point
- the likely consequences of the breach
- the measures taken or proposed to address it, including to mitigate possible adverse effects
Late or incomplete information
If you cannot notify within 72 hours, the notification must explain the reasons for the delay. If you do not have all the information at once, it may be provided in phases without undue further delay. Send what you know and update it.
Processors
A processor must notify the controller without undue delay after becoming aware of a breach. If you are a processor, check that your contracts and your own plan name who tells which customer and how fast. Controllers should confirm the same on their side when they review suppliers.
Document every breach
Controllers must document any personal data breach, including the facts, its effects and the remedial action taken. This applies even to breaches you decide not to notify. The records must allow the supervisory authority to verify compliance.
What this does not cover
This post covers one article. Other rules may also apply, such as duties to inform affected individuals, national laws and sector regulations. In the United States, for example, listed companies may face separate disclosure rules. See SEC Form 8-K Item 1.05. Ask counsel which apply to you.
Where Safeguard fits
Safeguard's compliance and evidence automation can help keep records such as incident logs and policies in one place for audits. It does not decide whether a breach is notifiable.
Quick check
Is a weekend included in the 72 hours?
The article speaks of hours, not working days, so plan as if weekends count.
Do we notify if we think the risk is low?
Not necessarily under Article 33, but you must still document the breach and your reasoning.
Sources
Last reviewed: 19 October 2026.
