GDPR Article 34 requires a controller to tell affected individuals without undue delay when a breach is likely to result in a high risk to their rights and freedoms. That bar is higher than the one for notifying the regulator, so some breaches go to the authority only.
Two thresholds, two audiences
Article 33 asks whether a breach is likely to result in any risk. Article 34 asks whether it is likely to result in a high risk. A breach that exposes names and work email addresses may need a regulator notice and no individual notice. A breach that exposes passwords, financial details or health information more often crosses the higher line.
Document the reasoning for both decisions, because a supervisory authority can review it. If you decide not to tell individuals, the authority can order you to, or decide that an exception applies.
What the message must say
The notice must describe the nature of the breach in clear and plain language. It must also include the contact point, the likely consequences and the measures taken or proposed, the same items listed for the regulator in Article 33(3). Skip legal phrasing. Say what happened, what data was involved, what the person should do, and how to reach you.
Useful practical content for people includes:
- Whether to change a password and where.
- Whether to watch for phishing that uses the leaked details.
- A named contact and a direct address, not a generic form.
The three exceptions
You do not have to notify individuals if any of these applies:
- Protection applied. Appropriate technical or organisational measures, such as encryption that makes the data unintelligible to anyone unauthorised, were in place for the affected data.
- Risk removed. Later steps mean the high risk is no longer likely to happen.
- Disproportionate effort. Contacting everyone one by one would take too much effort. You must then use a public communication or similar measure that informs people just as effectively.
Encryption only helps if the keys were not part of the breach. Say so in your record.
Making the decision repeatable
Build a short scoring sheet. Rate data type, volume, ease of identifying the person, severity of consequences for them, and whether the data was protected. Agree in advance who signs off. The sheet is evidence that you made a considered decision at the time.
Quick check
If we tell the regulator, must we also tell customers?
Not automatically. Individual notice is required where the breach is likely to cause a high risk to them.
Is a blog post enough?
Only under the disproportionate effort exception, where public communication must be as effective as direct contact.
For the regulator side of the process, see the 72 hour clock explained.
Sources
Last reviewed: 19 October 2026.
