# How fast must a data breach be reported under the GDPR?

Under Article 33 GDPR, the controller notifies the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people. Under Article 34, when the breach is likely to result in a high risk, the people affected must be told without undue delay. NetSenX prepares an Article 33 notification for your DPO; the decision and the submission stay with you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/how-fast-must-a-gdpr-breach-be-reported

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [What does the CRA require when a vulnerability is exploited?](https://netsenx.com/en/faq/what-does-the-cra-require-when-a-vulnerability-is-exploited)
- [Does DORA apply to us?](https://netsenx.com/en/faq/does-dora-apply-to-us)
- [What counts as a significant incident under NIS2?](https://netsenx.com/en/faq/what-counts-as-a-significant-incident-under-nis2)
- [Is a failed or blocked attack reportable under NIS2?](https://netsenx.com/en/faq/is-a-blocked-attack-reportable-under-nis2)
- [How can a small team meet the NIS2 24-hour early-warning deadline?](https://netsenx.com/en/faq/how-can-a-small-team-meet-the-nis2-24-hour-deadline)