How fast must a data breach be reported under the GDPR?

Under Article 33 GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., the controller notifies the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people. Under Article 34, when the breach is likely to result in a high risk, the people affected must be told without undue delay. NetSenX prepares an Article 33 notification for your DPODPO: data protection officer. The person responsible for data protection in a company under the GDPR.; the decision and the submission stay with you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics