We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?

Yes, in phases, and late only with reasons. Article 33(4) of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). allows the information to be provided in phases, without undue further delay, where it is not possible to provide it all at the same time, and Article 33(1) requires a notification made after 72 hours to be accompanied by the reasons for the delay. So do not wait for the full picture: send an initial notification within the deadline with what you know, the nature of the breach, likely consequences and measures taken so far, and the contact of your data protection officer, then update as facts arrive. Keep a record of when you became aware and why any part came later. Supervisory authorities usually provide online forms that support follow-ups. NetSenX prepares an Article 33 notification for your DPODPO: data protection officer. The person responsible for data protection in a company under the GDPR. from the incident data; submitting it stays with you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics