Articles 33 & 34 GDPR : Personal Data Breach Notification Procedure

Supervisory Authority Notification within 72 Hours (Art. 33 GDPR)

Article 33(1) GDPR provides that in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority.

Notification is strictly exempted only where the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

• Describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects and personal data records concerned;
• Communicate the name and contact details of the Data Protection Officer (DPO) or other contact point;
• Describe the likely consequences of the personal data breach;
• Describe the measures taken or proposed to be taken by the controller to address the breach, including measures to mitigate its possible adverse effects.

Where, and in so far as, it is not possible to provide the information at the same time, Article 33(4) permits the information to be provided in phases without undue further delay.

Communication to Data Subjects in Case of High Risk (Art. 34 GDPR)

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay in clear and plain language (Art. 34.1).

Communication to the data subject is not required if appropriate technological and organisational protection measures were applied (notably encryption rendering the data unintelligible to unauthorised persons), if subsequent measures ensure that the high risk is no longer likely to materialise, or if individual communication would involve disproportionate effort (in which case public communication or a similar effective measure is mandatory).

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework