Do I have to notify every data breach, even an email sent to the wrong colleague?

No. Paragraph 1 makes an exception where the breach is unlikely to result in a risk to the rights and freedoms of people. You do have to make and record that assessment, because paragraph 5 requires you to document all breaches, including those not notified. Recital 85 ties this to the accountability principle: you must be able to demonstrate why a risk is unlikely.

The 72 hours are almost up and I still do not know exactly what happened. What now?

Notify what you already know. Paragraph 4 allows you to provide the information in phases if you cannot give everything at once. If you notify later than 72 hours, you must give reasons for the delay (paragraph 1). Recital 85 confirms that a phased notification is permitted.

From when do the 72 hours start counting?

From the moment the controller becomes aware of the breach (paragraph 1). If your processor discovers the breach, it must notify you without undue delay (paragraph 2). Recital 87 says you should have appropriate measures in place to establish immediately whether a breach has taken place; you cannot stretch the deadline by not looking.

Article 33: Notification of a personal data breach to the supervisory authority

Praxikon tracks Article 33 (Notification of a personal data breach to the supervisory authority) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 33 sets out what a controller must do in the case of a personal data breach, in plain terms a data leak: data have for example been stolen, sent to the wrong person by mistake or become inaccessible. The controller notifies such a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of people (paragraph 1). A processor that discovers a breach notifies the controller without undue delay (paragraph 2). The notification has a fixed content (paragraph 3), may be completed in phases (paragraph 4), and every breach must be documented internally, even when no notification is needed (paragraph 5). Recital 85 explains why: a breach that is not addressed quickly can lead to identity fraud, financial loss, damage to reputation or loss of control over one's own data; if the breach is likely to result in a high risk, you must also inform the data subject directly under Article 34.

Key term: Breach notification duty: a personal data breach must, where feasible, be notified to the supervisory authority within 72 hours of becoming aware of it, unless a risk to data subjects is unlikely (paragraph 1)

Directly affects:controllerprocessordata protection officersupervisory authority

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

The processor shall notify the controller without undue delay after becoming aware of a personal data breach.

The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) describe the likely consequences of the personal data breach; (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.

The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Set up a procedure that lets you recognise a breach quickly, assess the risk to data subjects and, where a risk is not unlikely, notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware (paragraph 1). Make sure the notification contains the elements of paragraph 3 and complete it in phases if not everything is known yet (paragraph 4). Document every breach with the facts, its effects and the remedial action taken, even when you do not notify (paragraph 5).

Processor

Notify the controller without undue delay as soon as you discover a breach (paragraph 2). You do not notify the supervisory authority yourself; the controller does that (paragraph 1). Article 28(3)(f) also requires you to assist the controller with this notification duty.

Data Protection Officer

Your name and contact details go into the notification as the contact point where the supervisory authority can obtain more information (paragraph 3(b)). Make sure you are reachable and know the content of the notification.

Compliance checklist

There is a procedure by which breaches are recognised, reported internally and assessed for the risk to the rights and freedoms of data subjects (paragraph 1, recital 87).A breach that is likely to result in a risk is notified without undue delay and, where feasible, within 72 hours of becoming aware to the supervisory authority competent under Article 55 (paragraph 1).If the notification is made later than 72 hours, it is accompanied by reasons for the delay (paragraph 1).It is agreed with every processor that it notifies a breach to the controller without undue delay (paragraph 2).The notification describes the nature of the breach with categories and numbers of data subjects and records, the contact details of the data protection officer or another contact point, the likely consequences and the measures taken or proposed (paragraph 3).Information that is still missing is provided in phases without undue further delay (paragraph 4).All breaches, including those not notified, are documented with facts, effects and remedial action (paragraph 5).

Related recitals

(85)

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal dat...

(86)

The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the ...

(87)

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and ...

(88)

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, includin...

(89)

Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation produces administrative and financial burdens, it d...

Cross-references

Art. 55: Competence

Frequently asked questions

← Art. 32: Security of processing Art. 34: Communication of a personal data breach to the data subject →

Connections

Themes where this returns

Reporting: data breaches and serious incidents

The counterpart in the other law