What is the difference between notifying the supervisory authority and informing data subjects?

The threshold. Article 33(1) requires a notification to the supervisory authority as soon as a risk to data subjects is not unlikely. Article 34(1) requires a communication to the data subjects themselves only where a high risk is likely. In practice, every communication to data subjects therefore goes together with a notification to the supervisory authority, but not the other way round.

The stolen laptop was encrypted. Do I still have to inform the data subjects?

Paragraph 3(a) says the communication is not required if appropriate protection measures were applied to the affected data, in particular measures that render the data unintelligible to unauthorised persons, such as encryption. You do have to be able to show that the measure was actually applied to those data. The notification to the supervisory authority under Article 33 remains a separate assessment, and the authority can decide for itself whether the condition is met (paragraph 4).

It concerns tens of thousands of people for whom I have no contact details. Do I have to reach everyone personally?

Paragraph 3(c) provides a way out: if an individual communication would involve disproportionate effort, you may use a public communication or a similar measure, as long as data subjects are informed in an equally effective manner. Recital 86 adds that the communication should be made as soon as reasonably feasible, in close cooperation with the supervisory authority.

Article 34: Communication of a personal data breach to the data subject

Praxikon tracks Article 34 (Communication of a personal data breach to the data subject) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 34 sets out when you must inform the people concerned directly about a personal data breach. You must do so without undue delay when the breach is likely to result in a high risk to their rights and freedoms (paragraph 1), a higher threshold than the notification to the supervisory authority under Article 33, where an ordinary risk is enough. The communication must describe in clear and plain language what happened and contain at least the contact point, the likely consequences and the measures taken from Article 33(3)(b), (c) and (d) (paragraph 2). Recital 86 explains why: data subjects must be able to take precautions themselves. There are three exceptions, such as encryption of the affected data (paragraph 3), and the supervisory authority may still require you to communicate or may decide that an exception applies (paragraph 4).

Key term: High risk: the threshold above which you must inform the data subject directly; for an ordinary risk the notification to the supervisory authority under Article 33 is sufficient (paragraph 1)

Directly affects:controllerdata subjectsupervisory authority

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.

The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3).

The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; (b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise; (c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. Section 3 Data protection impact assessment and prior consultation

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

For every breach, assess whether a high risk to the data subjects is likely and, if so, inform them without undue delay, in clear and plain language, with the elements of Article 33(3)(b), (c) and (d) (paragraphs 1 and 2). Check whether one of the three exceptions in paragraph 3 applies and record that reasoning; where the effort would be disproportionate, use a public communication that reaches data subjects in an equally effective manner. Bear in mind that the supervisory authority can still require you to communicate (paragraph 4).

Processor

The article is addressed to the controller. Your role is limited to the assistance Article 28(3)(f) requires of you, such as quickly providing the facts the controller needs for the communication.

Data Protection Officer

Your contact details appear in the communication to data subjects, because paragraph 2 refers to Article 33(3)(b). Expect data subjects to put questions to you after the communication.

Data Subject

You hear it from the organisation itself when a data breach is likely to result in a high risk to you, in plain language and with the measures that have been taken (paragraphs 1 and 2, recital 86). If you hear nothing, that may mean the risk was low or that an exception in paragraph 3 applied; the supervisory authority can still require the organisation to communicate (paragraph 4).

Compliance checklist

For every breach it is assessed and recorded whether it is likely to result in a high risk to the rights and freedoms of data subjects (paragraph 1).Where a high risk is likely, data subjects are informed without undue delay (paragraph 1).The communication is written in clear and plain language and describes the nature of the breach (paragraph 2).The communication contains at least the contact point, the likely consequences and the measures taken or proposed from Article 33(3)(b), (c) and (d) (paragraph 2).Where no communication is made, it is recorded which exception in paragraph 3 applies: protection measures such as encryption that were applied to the affected data, subsequent measures that remove the high risk, or disproportionate effort.Where the effort would be disproportionate, there is a public communication or similar measure that informs data subjects in an equally effective manner (paragraph 3(c)).The organisation can promptly act on a requirement or decision of the supervisory authority under paragraph 4.

Related recitals

(85)

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal dat...

(86)

The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the ...

(87)

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and ...

(88)

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, includin...

(89)

Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation produces administrative and financial burdens, it d...

Cross-references

Art. 33: Notification of a personal data breach to the supervisory authority

Frequently asked questions

← Art. 33: Notification of a personal data breach to the supervisory authority Art. 35: Data protection impact assessment →

Connections

Themes where this returns

Reporting: data breaches and serious incidents

The counterpart in the other law

Guidelines

EDPB Template for personal data breach notification
2026-06-10 · adopted, European Data Protection Board (EDPB)
Guidelines 01/2021 on Examples regarding Personal Data Breach Notification
2021-12-14 · final, European Data Protection Board (EDPB)
Guidelines 9/2022 on personal data breach notification under GDPR
2023-03-28 · final, European Data Protection Board (EDPB)
Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens

Legislation in motion

Proposal: breach notification only for high risk, within 96 hours, via a single entry point (Article 33 GDPR)
2025-11-19 · proposal, Europese Commissie