Skip to main content
Praxikon
Agent check

Article 33: Notification of a personal data breach to the supervisory authority

Praxikon tracks Article 33 (Notification of a personal data breach to the supervisory authority) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

What does Article 33 govern?

Article 33 sets out what a controller must do in the case of a personal data breach, in plain terms a data leak: data have for example been stolen, sent to the wrong person by mistake or become inaccessible. The controller notifies such a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of people (paragraph 1). A processor that discovers a breach notifies the controller without undue delay (paragraph 2). The notification has a fixed content (paragraph 3), may be completed in phases (paragraph 4), and every breach must be documented internally, even when no notification is needed (paragraph 5). Recital 85 explains why: a breach that is not addressed quickly can lead to identity fraud, financial loss, damage to reputation or loss of control over one's own data; if the breach is likely to result in a high risk, you must also inform the data subject directly under Article 34.

Key term: Breach notification duty: a personal data breach must, where feasible, be notified to the supervisory authority within 72 hours of becoming aware of it, unless a risk to data subjects is unlikely (paragraph 1)

Directly affects:controllerprocessordata protection officersupervisory authority

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

/
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) describe the likely consequences of the personal data breach; (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Decision tree

Do you need to report a data breach?

The 72-hour period runs from the moment you become aware of the breach. According to the EDPB guidelines, that is when you are reasonably certain that a breach has occurred; the GDPR itself does not say so in those words. So act immediately, even if not all information is known yet: you may report in phases (Article 33(4)).

Question 1 · Art. 4(12)

Is there a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data?

Think of an email with personal data sent to the wrong recipient, a stolen laptop, ransomware or a database that is temporarily unavailable. Loss of availability also counts.

Full diagram
  1. 1

    Is there a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data?

    Art. 4(12)

    • Yes → Question 2
    • No → Outcome A
  2. 2

    Do you process the affected data as a processor, on behalf of another organisation?

    Art. 33(2)

    • Yes, we are the processor → Outcome B
    • No, we are the controller → Question 3
  3. 3

    Is the breach unlikely to result in a risk to the rights and freedoms of natural persons?

    Art. 33(1)

    • Yes, unlikely → Outcome C
    • No, there is a risk or doubt → Question 4
  4. 4

    Is the breach likely to result in a high risk to the rights and freedoms of the data subjects, for example identity fraud, financial loss, discrimination or reputational damage?

    Art. 34(1)

    • Yes → Question 5
    • No → Outcome D
  5. 5

    Does one of the exceptions to informing data subjects apply?

    Art. 34(3)

    • The data were rendered unintelligible, such as by encryption → Outcome E
    • We took subsequent measures so that the high risk is no longer likely → Outcome E
    • Informing individually would involve disproportionate effort → Outcome F
    • None of these → Outcome G

Outcome A · Does not apply

Not a personal data breach under the GDPR

Without effects on personal data there is no notification obligation under the GDPR. A security incident may still fall under other notification obligations, for example in sectoral or cybersecurity legislation.

Art. 4(12)

Outcome B · Applies

Notify the breach to your client without undue delay

As processor you do not notify the supervisory authority yourself, but notify the controller without undue delay. The controller decides on the notification. Provide the information the controller needs and follow the arrangements in the processing agreement.

Art. 33(2) · Art. 28(3)(f)

Outcome C · Partly applies

Do not notify, but document

If the breach is unlikely to result in a risk, you need not notify the Dutch Data Protection Authority. Always document the breach in your own register: facts, effects and remedial action taken (Article 33(5)). Also record why you considered the risk unlikely.

Art. 33(1) · Art. 33(5)

Outcome D · Applies

Notify the Dutch Data Protection Authority within 72 hours

Notify without undue delay and where feasible within 72 hours of becoming aware: the nature of the breach, categories and numbers of data subjects and records, the contact point, the likely consequences and the measures. Late notification must be accompanied by reasons. Always document the breach in your own register: facts, effects and remedial action taken (Article 33(5)).

Art. 33(1) · Art. 33(3) · Art. 33(4) · Art. 33(5)

Outcome E · Partly applies

Notify the DPA; informing data subjects is not required

Notify the Dutch Data Protection Authority within 72 hours. Because of the encryption or the measures taken you need not inform data subjects, but the authority may still require it. Always document the breach in your own register: facts, effects and remedial action taken (Article 33(5)).

Art. 33(1) · Art. 34(3)(a) en b · Art. 34(4) · Art. 33(5)

Outcome F · Applies

Notify the DPA and inform through a public communication

Notify the Dutch Data Protection Authority within 72 hours. If informing individuals would involve disproportionate effort, make a public communication or similar measure that informs data subjects in an equally effective manner. Always document the breach in your own register: facts, effects and remedial action taken (Article 33(5)).

Art. 33(1) · Art. 34(3)(c) · Art. 33(5)

Outcome G · Applies

Notify the DPA and inform the data subjects

Notify the Dutch Data Protection Authority within 72 hours and inform the data subjects without undue delay, in clear and plain language: what happened, the likely consequences, the measures taken, the contact point and what they can do themselves. Always document the breach in your own register: facts, effects and remedial action taken (Article 33(5)).

Art. 33(1) · Art. 34(1) · Art. 34(2) · Art. 33(5)

A decision tree simplifies. If you are unsure at a question, read the provision or have it assessed. Checked against the legal text on 1 October 2026.

What does this mean for you?

Controller

Set up a procedure that lets you recognise a breach quickly, assess the risk to data subjects and, where a risk is not unlikely, notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware (paragraph 1). Make sure the notification contains the elements of paragraph 3 and complete it in phases if not everything is known yet (paragraph 4). Document every breach with the facts, its effects and the remedial action taken, even when you do not notify (paragraph 5).

Processor

Notify the controller without undue delay as soon as you discover a breach (paragraph 2). You do not notify the supervisory authority yourself; the controller does that (paragraph 1). Article 28(3)(f) also requires you to assist the controller with this notification duty.

Data Protection Officer

Your name and contact details go into the notification as the contact point where the supervisory authority can obtain more information (paragraph 3(b)). Make sure you are reachable and know the content of the notification.

Compliance checklist

Related recitals

(85)

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal dat...

(86)

The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the ...

(87)

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and ...

(88)

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, includin...

(89)

Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation produces administrative and financial burdens, it d...

Cross-references

Art. 55: Competence

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Guidelines and decisions (1)

  • 19 November 2025 · COM(2025) 837 · European Commission
    Digital Omnibus: proposal amending the GDPR

    Legislative proposal that would introduce, among other things, a relative definition of personal data, breach notification only for high risk and cookie rules within the GDPR itself. It is a proposal, not law in force.

Fines (1)

  • 12 December 2024 · Data Protection Commission (Ireland)€251,000,000
    Meta: data breach via the 'View As' feature

    Through a Facebook vulnerability, unauthorised persons gained access to about 29 million accounts in 2018, around 3 million of them in the EU. Meta's breach notification was incomplete, its documentation was inadequate, and data protection was not built into design and default settings.

    Two decisions of 12 December 2024, announced on 17 December 2024. Meta announced an appeal; whether one was lodged has not been verified.

Checked on 5 November 2026

Frequently asked questions

← Art. 32: Security of processingArt. 34: Communication of a personal data breach to the data subject →

Connections

What connects to Article 33 GDPR

Themes where this returns

The counterpart in the other law

Case law

Guidelines

Legislation in motion

Analysis