When does the GDPR 72-hour notification clock start?
When the controller becomes aware of the personal data breach, not when the breach began. Article 33(1) counts the 72 hours from becoming aware. Guidelines from the European Data Protection Board treat a controller as aware when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. A short initial investigation to establish that is allowed, but it must be prompt; you cannot delay awareness by not looking. A processor that discovers a breach must tell the controller without undue delay (Article 33(2)), and the controller's clock generally starts when it learns of it. So record, in your incident log, the exact time someone concluded that personal data was involved. NetSenX lets you record the awareness time per incident, and keeps the alerts that show when the activity started.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- One incident, several reports: how do NIS2, the GDPR and DORA fit together?
- What is a major ICT-related incident under DORA?
- What are the DORA incident reporting deadlines?
- Where are Cyber Resilience Act vulnerability reports submitted?
- Should we report a cyber incident to the police as well as the regulator?
← All 35 questions on Incident reporting deadlinesAll topics