Reporting a data breach under GDPR Art. 33: step by step

If the protection of personal data has been breached, a company must notify the competent data protection authority under Art. 33 GDPR without undue delay and, where feasible, within 72 hours of becoming aware of it. The exception is a breach that is unlikely to result in a risk to the individuals concerned. Even then it must be documented internally. If the risk is likely to be high, the individuals concerned must be informed as well (Art. 34 GDPR).

When is a data breach reportable?

The GDPR speaks of a “personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Examples:

A malware attack in which customer or employee data leaves the company
An email with personal data sent to the wrong recipient
A lost or stolen unencrypted laptop containing customer data
A third party gaining access to an account with personal data after a phishing attack

The 72-hour deadline

The clock starts when the company becomes aware of the breach. Supervisory authorities generally read this as the point at which there is a reasonable degree of certainty that a security incident has compromised personal data. The deadline runs in hours, and weekends and public holidays are generally understood to count.

If the deadline is missed, the delay must be justified to the authority. If not all information is available yet, the notification can be provided in phases (Art. 33(4) GDPR).

What the notification must contain (Art. 33(3))

The nature of the breach, where possible including the categories and approximate number of individuals and records concerned
The name and contact details of the data protection officer or another contact point
The likely consequences of the breach
The measures taken or proposed to address the breach and mitigate possible adverse effects

Who receives the notification?

The competent data protection authority. It depends on where your company is established, and with cross-border processing a lead authority may be responsible. Many authorities offer an online notification form. Check your authority’s procedure in advance, not in the middle of an incident.

Documentation duty (Art. 33(5))

Every breach must be documented, even if no notification is required. Record the facts, the effects and the remedial action taken. The authority may inspect this record. Also note why you assessed the risk as low.

Informing the individuals concerned (Art. 34)

If the breach is likely to result in a high risk to individuals’ rights and freedoms, they must be informed without undue delay in clear and plain language. Exceptions apply, among others, where the data was protected by suitable measures such as encryption, where follow-up measures rule out the high risk, or where informing individuals would involve disproportionate effort. In that case a public communication is required.

Service providers and processors

Processors must notify the controller without undue delay (Art. 33(2)). The controller’s 72 hours run from its own awareness. Regulate in your data processing agreement how and how quickly your provider informs you, and know which providers have access to personal data.

Other reporting duties

Depending on your sector and classification, further reporting duties may apply, for example under the NIS2 Directive (for significant incidents it provides for an early warning within 24 hours, a notification within 72 hours and a final report after one month) or under DORA for financial entities. Whether and from when these apply to your company depends on national implementation and your classification and should be checked case by case.

Checklist for the first 72 hours

Record the time you became aware
Inform the data protection officer and management
End the access, lock affected accounts, secure evidence
Narrow down the data types and the group of individuals affected
Assess the risk to individuals and write down the reasoning
Prepare the notification to the authority, in stages if necessary
Document the decision on informing the individuals concerned

What is at stake

Infringements of the notification duties can be fined under Art. 83(4) GDPR with up to 10 million euros or 2 % of total worldwide annual turnover, whichever is higher. The actual amount depends on the circumstances.

Note

This guide is a general overview and not legal advice. In a concrete incident, involve your data protection officer and, where appropriate, legal counsel.

Frequently asked questions

Do I have to report if only employee data is affected?

Yes. The GDPR also protects employees’ personal data. What matters is whether the breach is likely to result in a risk to the individuals concerned.

Does the 72-hour deadline apply on weekends?

It is generally understood to keep running. Prepare the process in advance and justify any delay to the authority.

What if not all information is available yet?

You can notify in phases and add information later (Art. 33(4) GDPR). Do not postpone the notification until everything is clarified.

Does a data breach check help with the notification?

It can indicate whether addresses or credentials of your domain have appeared in known sources. It replaces neither the forensic investigation nor the risk assessment.

Is your domain affected? The free BreachFinder check shows known data breaches for your domain.

Related guides

Updated: 2026-09-26. General information, not legal advice.