GDPR Breach Notification: The 72-Hour Rule

It’s Friday at 6 p.m. and someone in finance has just emailed a spreadsheet of 2,000 customer records to the wrong distribution list. Under GDPR you may have until Monday evening to notify your data protection authority, and the clock is already running.

Articles 33 and 34 of the GDPR set out when you must report a personal data breach, to whom, and what you must say. This guide explains the rules, shows how the European Data Protection Board (EDPB) applies them, and gives you an hour-by-hour plan for the first 72 hours.

What counts as a personal data breach

Article 4(12) GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data that is transmitted, stored or otherwise processed.

The EDPB groups breaches into three types, and one incident can be more than one:

• Confidentiality breach: unauthorised or accidental disclosure of, or access to, personal data. Examples: an email sent to the wrong recipients, or data exfiltrated by an attacker.
• Integrity breach: unauthorised or accidental alteration of personal data.
• Availability breach: accidental or unauthorised loss of access to, or destruction of, personal data. Ransomware that encrypts records with no usable backup is the classic case.

Two points people often miss. First, a breach does not need an attacker: a lost laptop, a misdirected letter or an internal mistake all count. Second, a temporary loss of availability is still a breach. Planned maintenance is not, because it is not a breach of security.

Notifying the supervisory authority (Article 33)

The rule

The controller must notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. If you file later than 72 hours, you must explain the delay. You do not need to notify if the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Note the threshold: you notify unless risk is unlikely. When in doubt, the EDPB’s advice is to notify.

When does the clock start?

The EDPB says you become “aware” when you have a reasonable degree of certainty that a security incident has led to personal data being compromised. After an alert, you may run a short investigation to establish whether a breach has really happened. While that investigation runs, you are not yet “aware”. It must start straight away, though, and it should be brief. Slow-walking it to delay the clock can itself breach Article 33.

The EDPB’s own examples:

• You lose a USB key with unencrypted personal data. You are aware when you realise it is lost, even if you can’t tell whether anyone has read the data, because availability has been lost for certain.
• A third party tells you they received a customer’s data by mistake and shows you the evidence. You are aware immediately.
• An attacker contacts you demanding a ransom. Once you have checked your systems and confirmed the attack, you are aware.

Processors and joint controllers

A processor that becomes aware of a breach must tell the controller “without undue delay” (Article 33(2)). It does not assess the risk first; that is the controller’s job. In principle the controller is “aware” once the processor has told it. Agree specific notification deadlines in your Article 28 contracts so your processors leave you enough of the 72 hours. Joint controllers should agree in their arrangement who leads on notification.

What to include (Article 33(3))

The notification must at least:

1. describe the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned
2. give the name and contact details of the DPO or another contact point
3. describe the likely consequences of the breach
4. describe the measures taken or proposed to address the breach and mitigate its effects

If you don’t have everything yet, Article 33(4) lets you provide the information in phases, without further undue delay. File what you know within 72 hours, then follow up. If you later find the breach was not real (the “lost” USB key turns up in a drawer), update the authority.

Which authority?

For cross-border processing, you notify your lead supervisory authority under the one-stop-shop (Article 56). Controllers outside the EU are different. The EDPB’s Guidelines 9/2022 (version 2.0, adopted 28 March 2023) clarify that having an Article 27 representative does not trigger the one-stop-shop. Such controllers must notify every supervisory authority in whose Member State affected data subjects live.

Telling the people affected (Article 34)

If the breach is likely to result in a high risk to individuals, you must also inform the data subjects without undue delay. Use clear and plain language. Explain the nature of the breach, give your DPO or contact point, describe the likely consequences and the measures taken, and say what they can do to protect themselves (for example, change passwords or watch for phishing; see how to spot phishing).

Article 34(3) lists three exceptions:

• the data was protected so that it is unintelligible to anyone not authorised to access it, for example by state-of-the-art encryption with an uncompromised key
• you have since taken measures that make the high risk no longer likely to materialise
• contacting each person individually would involve disproportionate effort. In that case you must use a public communication or a similarly effective measure instead.

The supervisory authority can order you to inform data subjects, or decide that an exception applies (Article 34(4)).

EDPB examples: notify or not?

Annex B of Guidelines 9/2022 works through common scenarios. A selection:

For risk scoring, the EDPB points to ENISA’s methodology for assessing the severity of personal data breaches.

The documentation duty (Article 33(5))

You must document every personal data breach, notified or not: the facts, its effects and the remedial action taken. The authority must be able to use the record to check your compliance. The EDPB recommends you also record:

• your reasoning for each decision, especially why you did not notify
• evidence for any Article 34(3) exception you relied on
• reasons for any late notification
• evidence of what you told data subjects

An internal breach register is the simplest way to do this. Poor documentation can on its own lead to corrective action or fines. Breach notification failures fall in the GDPR fine tier of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)).

Your first 72 hours: a step-by-step plan

This plan assumes you already have an incident response process (see what is incident response). It adds the GDPR-specific steps.

Hour 0–4: contain and start the log

1. Contain the incident: isolate systems, revoke credentials, recall emails where possible.
2. Preserve evidence: logs, emails, images of affected systems.
3. Open a breach record with timestamps. Write down when you first got the alert and who knows.
4. Alert the DPO, legal, IT security and the decision-maker for notifications.

Hour 4–24: establish the facts

1. Confirm whether personal data was involved. Note the time you reached reasonable certainty: that is when your 72 hours start.
2. Scope it: which systems, which data categories (any special category data, such as health?), how many people and records, which countries.
3. If a processor is involved, get its written account. If you are the processor, tell your controllers now.
4. Check other regimes: NIS2 early warnings are due within 24 hours, and DORA initial notifications within 4 hours of classification. See NIS2 vs DORA vs GDPR.

Hour 24–48: assess risk and decide

1. Assess the likelihood and severity of harm to individuals: identity theft, fraud, discrimination, loss of confidentiality, physical harm, distress.
2. Decide: no notification (record why), notify the authority, or notify the authority and the data subjects.
3. Identify the competent or lead authority.
4. Draft the notification and, if needed, the message to data subjects.

Hour 48–72: notify and communicate

1. File the notification. If facts are still missing, file an initial notification and say that more will follow.
2. Inform data subjects without undue delay if the risk is high.
3. Prepare customer service and communications teams with a consistent script, and warn them that criminals often follow a breach with targeted phishing (see protecting against social engineering).

After 72 hours

1. Send supplementary information to the authority as you learn more.
2. Complete the breach record, including root cause and remediation.
3. Run a lessons-learned review, and test the process in your next tabletop exercise (see our tabletop exercise guide).

Italy: notifying the Garante

In Italy, controllers must notify the Garante per la protezione dei dati personali through its online procedure at servizi.gpdp.it/databreach. The procedure has been mandatory since 1 July 2021, under the Garante’s decision of 27 May 2021. The same portal offers a self-assessment tool to help you decide whether a notification is needed. It also has a facsimile of the form, so you can see the questions in advance; don’t use the facsimile to file. The Garante treats an incomplete or preliminary notification as needing a supplementary filing to complete the process. Build the portal’s questions into your Italian breach playbook now, not on the night of the incident.

A note on proposed changes

The European Commission’s Digital Omnibus proposal of November 2025 would raise the authority-notification threshold to “high risk”, extend the deadline to 96 hours, and add a single EU reporting entry point. It is a proposal. Until any change is adopted and applies, the 72-hour rule described here stands.

This is general guidance, not legal advice.

AceFortis runs practical training on GDPR breach response for IT, security and privacy teams, including timed notification drills built on your own processes. Get in touch to plan a session.

FAQ

Do weekends and holidays count towards the 72 hours?

Yes. GDPR counts 72 hours, not working days. Plan cover so someone can file at any time.

What if we can’t gather all the details within 72 hours?

Notify with what you have, state that more information will follow, and provide it in phases without undue further delay. A late notification must include the reasons for the delay.

Is a ransomware attack always notifiable?

Not always. If you restore from backup in good time and there is no evidence of exfiltration, the EDPB says notification may not be needed, though you must still record the incident. If data was exfiltrated or cannot be restored, notification is likely.

Our cloud provider had the breach. Who notifies?

You do, as controller. The provider, as processor, must tell you without undue delay. A processor may file on your behalf if your contract authorises it, but the legal responsibility stays with you.

Sources

• Regulation (EU) 2016/679 (GDPR), EUR-Lex
• EDPB Guidelines 9/2022 on personal data breach notification (v2.0)
• Garante Privacy: Data breach
• Garante decision of 27 May 2021: online data breach notification procedure
• ENISA: methodology for assessing the severity of personal data breaches