GDPR Article 33 requires notifying the supervisory authority of a personal data breach, where feasible within 72 hours of becoming aware. Only breaches unlikely to result in a risk are exempt, and with no EU office the EDPB says you notify every authority where affected people live.
This guide is for compliance managers, DPOs and CISOs in GCC companies serving people in the EU, and for their processors.
What does Article 33 require after a personal data breach?
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data (Article 4(12)). It covers availability as well as confidentiality, so ransomware that locks records can be a breach.
A processor must tell its controller without undue delay, with no hour figure set (Article 33(2)). The controller must notify without undue delay and, where feasible, within 72 hours. A later notice must give the reasons for the delay. Under Article 33(3) the notice must contain at least:
- the nature of the breach, with approximate numbers of people and records where possible
- the name and contact details of the DPO or another contact point
- the likely consequences
- the measures taken or proposed, including steps to limit the harm
You may send the information in phases (Article 33(4)). Article 33(5) requires you to document every breach, notified or not, so the authority can check your decisions.
When does the 72-hour clock start, and does it stop at weekends?
The clock starts when you become aware, not when an alert first fires. Awareness means a reasonable degree of certainty that a security incident has compromised personal data. The European Data Protection Board (EDPB) sets this test in its Guidelines 9/2022 on personal data breach notification, Version 2.0 of March 2023.
After an alert you may run a short investigation, and you are not treated as aware while it runs. It must start as soon as possible, and failing to act in time can itself be a failure to notify. A lost unencrypted USB key makes you aware the moment you realise it is gone.
Weekends do not pause the clock. The EDPB points to Regulation (EEC, Euratom) No 1182/71, under which periods include Saturdays, Sundays and public holidays. Its roll-forward to the next working day does not apply to hour periods. Awareness at 16:20 on a Thursday means filing by Sunday afternoon.
When the breach happens at a processor, you are in principle aware once the processor tells you. Log the time of that message.
Do you have to notify, and when must you tell individuals?
Telling the people affected has a higher bar. Article 34 requires it only where a high risk is likely. It is not required where encryption made the data unintelligible or later measures removed the high risk. Where it would take disproportionate effort, a public notice or similar measure replaces it.
The EDPB's worked examples, most from its Guidelines 01/2021, show where the lines fall. Every row still goes into your Article 33(5) record.
| Situation | Tell the authority? | Tell individuals? | Why |
|---|---|---|---|
| Securely encrypted laptop lost, key safe, backup exists | No | No | Data unintelligible and still available |
| Ransomware, proper backup, no data taken | No | No | Unlikely to result in a risk |
| Ransomware, no proper backup | Yes | Only if high risk | Recovery is delayed |
| Ransomware with data taken, no backup | Yes | Yes | High risk |
| Credential stuffing on a banking website | Yes | Yes, all 100,000 users | Not only compromised accounts |
| Passwords stolen, hashed and salted to a state-of-the-art standard | No | Not required, strongly advisable | State-of-the-art hashing protects them |
| Power cut of a few minutes at a call centre | No | No | Only minutes of unavailability |
| Marketing email with all recipients visible in "cc" | Depends | If high risk | Number of people and sensitivity of data |
Encryption only helps if it was real. If the data was not securely encrypted, not notifying is itself a breach of Article 33. For health data, political opinions and other special categories, the EDPB says damage should be considered likely. If in doubt, notify.
Tell individuals in a dedicated message, not a newsletter or a press release alone. The EDPB says the language you normally use with the customer is generally appropriate.
Which authority do you notify if you have no office in the EU?
A controller with no EU establishment caught by Article 3(2) is bound by Articles 33 and 34 like an EU company. That covers offering goods or services to people in the EU or monitoring them there.
It cannot use the one-stop shop. The EDPB revised paragraph 73 of Guidelines 9/2022 in March 2023 to say so: an Article 27 representative does not create a lead authority. You must notify every supervisory authority in whose Member State affected people live. Affected customers in France, Germany and Spain mean three notices.
The duty stays with you. The representative takes part only if its written mandate says so. A company with an EU establishment that processes across borders notifies its lead authority under Article 56 instead.
A Gulf processor serving an EU-targeting controller must tell that controller without undue delay, and that message can start the controller's 72 hours. Agree early-notice terms in the contract.
Home law can apply at the same time. Saudi PDPL Implementing Regulation Article 24(1) also sets 72 hours for notice to the competent authority where an incident may cause harm. The trigger wording differs. Our guide to Saudi PDPL enforcement covers the Saudi side.
What have authorities fined for late or incomplete notices?
Notification failures sit in the Article 83(4)(a) tier: up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Failing to notify and weak security are separate infringements.
Booking.com, EUR 475,000 (Dutch authority, 31 March 2021). In December 2018 criminals phoned 40 hotels in the United Arab Emirates and talked staff into revealing log-ins to a Booking.com system. They reached data of 4,109 people who had booked UAE hotel rooms, plus card details of 283 people. Booking.com learned of it on 13 January 2019 and reported it on 7 February, which the Autoriteit Persoonsgegevens called 22 days too late.
The fine was on the platform, not the hotels. But for a Gulf hotel, tour operator or booking partner, an EU-regulated breach can start with your own staff.
Twitter, EUR 450,000 (Irish Data Protection Commission, 15 December 2020). It failed to notify on time under Article 33(1) and to document the breach adequately under Article 33(5).
Meta, EUR 251 million (Irish Data Protection Commission, 17 December 2024). EUR 8 million was for a notice missing information it should have included (Article 33(3)). EUR 3 million was for breach records that did not let the authority verify compliance (Article 33(5)). The rest was for privacy by design and by default.
PVV Overijssel, EUR 7,500 (Dutch authority, 11 May 2021). An invitation email showed 101 addressees as "friends of the PVV", revealing their political opinions. The party never reported it.
What will an authority ask to see after a breach?
- When did you become aware, and why then? A timeline from first alert to reasonable certainty.
- Why was the notice late? The written reasons you sent with it.
- Which authorities did you notify? For a non-EU controller, the Member States where affected people live and a notice to each.
- Did your notice cover all four Article 33(3) items, with follow-ups if you sent it in phases?
- Your breach register, including breaches you did not report and why.
- When your processor told you, and what the contract requires.
Our guides to ISO/IEC 27001:2022 and ISO/IEC 27701 show how an ISMS or PIMS produces this evidence.
How AGS can help
The EU GDPR Personal Data Breach Response Management System holds 331 editable documents: 279 Microsoft Word and 52 Excel files. They include a 72-Hour Deadline Calculation Record, a Competent Supervisory Authority Assessment, a Non-Notification Justification Form, an Article 33(5) Personal Data Breach Register and eight completed fictional examples. For a company with no EU establishment, it records the establishment and representative assessments and leaves the notification position to legal advice. It reproduces no authority's own form.
Frequently asked questions
Is the GDPR 72-hour deadline changing to 96 hours?
No. The Digital Omnibus, COM(2025) 837, proposes notifying the authority only of high-risk breaches, within 96 hours, through a single entry point. It is still a proposal awaiting a European Parliament committee decision. As proposed, it would apply 18 months after entry into force, or 24 months if the single entry point is not ready.
What if we notify and it turns out not to be a breach?
There is no penalty. The EDPB says you can update the authority and ask for the notice to be amended.
Can several similar breaches go in one notice?
Yes, if they involve the same data, breached the same way, over a short period. That may justify some delay beyond 72 hours, but delay should not be routine.
Does NIS2 incident reporting replace GDPR breach notification?
No. NIS2 sets its own track for significant incidents at essential and important entities: an early warning within 24 hours, an incident notification within 72 hours and a final report one month after that notification.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the European Data Protection Board or any supervisory authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
