GDPR Article 33

How it works

Article 33(1) of Regulation (EU) 2016/679 says that in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If notification is not made within 72 hours, it shall be accompanied by reasons for the delay.

Article 4(12) defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Article 33(2) says the processor shall notify the controller without undue delay after becoming aware of a personal data breach.

What the notification contains

Article 33(3) says the notification shall at least describe the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned. It shall give the name and contact details of the data protection officer or other contact point, describe the likely consequences of the breach, and describe the measures taken or proposed to address it, including measures to mitigate possible adverse effects.

Article 33(4) allows information to be provided in phases without undue further delay when it cannot all be provided at the same time. Article 33(5) requires the controller to document any personal data breaches, comprising the facts, effects and remedial action, so the supervisory authority can verify compliance.

Article 34 is a separate duty to inform individuals. Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate it to the data subject without undue delay. Article 34(3) lists conditions in which this is not required, including where appropriate protection measures, such as encryption, were applied to the affected data. Whether a given measure meets that test is a legal question.

How it connects to stolen data and executives

Breach notification concerns incidents at the organization that holds the data. An executive can appear in two ways: their own records may be in a breach at a company that holds their data, and the organization they lead may suffer a breach that triggers its own duty. A notification does not stop records from being posted or traded afterward. How stolen data is sold describes where that happens. Knowing which executive records already appear in a breach corpus helps a legal team judge what a new incident adds, and CEM shows that per executive with a dated record.

Practical steps

Prepare before an incident. Decide who judges whether a breach is likely to pose a risk, who decides to notify, how the moment of awareness is logged, and how processors will inform the organization. Practice the 72-hour step. Take legal advice on any real event, because counsel decides whether a particular incident must be notified. This page is general information and not legal advice.

How it differs from related terms

NIS2 Article 23 has its own timeline of 24 and 72 hours for significant incidents, addressed to a CSIRT or competent authority. DORA Article 19 requires financial entities to report major ICT-related incidents to the relevant competent authority. GDPR Article 33 is limited to personal data breaches and is addressed to the supervisory authority. A single incident can trigger more than one of them.