Question 1

What does GDPR Article 33 require for data breaches?

Accepted Answer

Article 33 GDPR requires data controllers to notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible. The notification must include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

Question 2

When does the 72-hour GDPR clock start?

Accepted Answer

The 72-hour clock starts when the controller "becomes aware" of a personal data breach — meaning when the controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Investigating an incident delays awareness; once confirmed, the 72-hour window begins.

Question 3

What happens if I miss the GDPR 72-hour deadline?

Accepted Answer

Missing the 72-hour notification deadline is itself a GDPR violation subject to Article 83(4) fines of up to €10 million or 2% of global annual turnover. Late notifications must include reasons for the delay. Supervisory authorities consider timeliness of notification as a mitigating or aggravating factor in fine calculations.

GDPR Breach Notification Timer