Articles 33–34
A GDPR breach response, from the first alert to the last message.
The legal duty is short. The hard part is the judgment calls along the way: is this a breach at all, when did you know, and how badly could people be hurt? Get those three right and the 72-hour limit for telling the regulator becomes manageable. This page walks the calls in the order you will face them.
Back to GDPR services01 · Is it a breach?
Call one: has personal data been compromised?
A breach is a security failure that hits personal data in one of three ways.
Not every security incident is a personal data breach. The GDPR definition needs two things: a failure of security, and a result where personal data is destroyed, lost, changed, disclosed or accessed without permission, whether by accident or on purpose. Regulators sort the results into three types.
- Confidentiality breach
- Someone saw data they should not. Illustrative: an invoice batch emailed to the wrong customer.
- Integrity breach
- Data was changed without authority. Illustrative: an attacker edits bank details on supplier records.
- Availability breach
- Data was lost or locked away. Illustrative: ransomware encrypts the only copy of a patient schedule, even briefly.
One incident can be all three at once. A blocked phishing email with no data touched is a security event, not a personal data breach, but log it anyway.
02 · When you knew
Call two: the moment you became aware
The deadline runs from reasonable certainty, not from a finished investigation.
Under EDPB guidance, a controller is aware once it is reasonably certain that a security incident has compromised personal data. A short first look to establish that is allowed. Weeks of internal debate are not. When a processor reports an incident to you, treat its report as the point of awareness for planning purposes.
Seventy-two clock hours
The limit counts every hour, nights and public holidays included. If you miss it, the notice that finally goes out must give the reasons for the delay.
03 · The risk test
Call three: how much harm could follow
One risk judgment sets who hears about it.
| Your assessment of risk to people | Supervisory authority | Affected individuals | Internal breach log |
|---|---|---|---|
| Unlikely to cause any risk | Not required | Not required | Yes, with your reasoning |
| A risk exists | Yes, within 72 hours of awareness | Not required | Yes |
| High risk | Yes, within 72 hours of awareness | Yes, without undue delay | Yes |
Judge risk from the person's side: how sensitive the data is, whether it identifies them easily, how many are affected, whether they are vulnerable, and what someone could do with it. A leaked list of newsletter emails and a leaked set of passport scans are not the same event.
04 · Working the incident
The work inside the window
Four stages, run in parallel where you can.
Confirm
Establish that personal data is involved and start the record.
- What happens
- Triage the alert
- Name an incident lead
- Note the time of awareness
- You get
- A first entry in the breach log
- Good practice
- The awareness time is written down, not reconstructed later
- Watch for
- Waiting for forensics before anyone decides
Contain and assess
Stop the leak and work out who and what is affected.
- What happens
- Revoke access, recall emails, isolate systems
- Estimate categories and numbers of people and records
- You get
- A risk rating with reasons
- Good practice
- Approximate numbers are recorded as approximate
- Watch for
- Wiping logs you will need as evidence
Notify the authority
File with the lead or competent supervisory authority.
- What happens
- Send what you know now
- Mark what is still unknown
- You get
- A filed notice and its reference
- Good practice
- Follow-up information sent in stages as facts arrive
- Watch for
- Holding the notice until every detail is known
Tell people and close
Write to those at high risk and finish the record.
- What happens
- Send plain-language messages
- Record lessons and fixes
- You get
- A closed log entry with evidence
- Good practice
- Concrete advice people can act on
- Watch for
- Legal wording that hides what happened
05 · What to write
Two messages, two readers
The regulator wants facts; the public wants to know what to do.
To the supervisory authority
- What happened, with categories and approximate numbers of people and records
- Name and contact details of the DPO or another contact
- Likely consequences
- Measures taken or planned, including steps to limit harm
To affected individuals
- Written in clear and plain language
- The same contact point, consequences and measures
- Practical steps, such as changing a password or watching statements
- Individual messages can be skipped if the data was unintelligible to anyone without the key, if later action means the high risk is no longer likely, or if reaching each person would take disproportionate effort, in which case a public announcement takes their place.
- The authority can still order you to tell people if it disagrees with your risk call.
06 · Vendors and groups
Processors, group companies and firms outside the EU
Who files depends on who controls the data and where.
- A processor files nothing with the authority for its client's data. It must alert the controller without undue delay, and contracts often set a shorter internal deadline.
- A controller with a main establishment in the EU usually files with its lead supervisory authority.
- EDPB guidance updated in 2023 says a controller outside the EU cannot use that single point of contact, even with an EU representative: it notifies the authority in each member state where affected people live.
Serving India too? The DPDP Act sets its own breach duty with no risk threshold for telling people; the linked DPDP guide covers it.
Sources: Regulation (EU) 2016/679 (GDPR), Articles 4(12), 28, 33, 34 and 83(4); EDPB Guidelines 9/2022 on personal data breach notification under GDPR (version 2.0); EDPB Guidelines 01/2021 on examples regarding personal data breach notification.
Breach questions from the incident room
We only know half the facts. File now or wait?
File now and add the rest later.
Article 33 lets you provide information in phases. An incomplete notice on time is better than a complete one late. Say clearly which points are still being investigated.
The stolen laptop was encrypted. Is that still a breach?
Yes, but often one with no notice needed.
Losing the device is still a breach and goes in your log. If strong encryption was on and the key is safe, the risk to people may be low enough that neither the authority nor individuals need notice. Record why you concluded that.
Our cloud vendor had the incident. Who reports it?
You do, as controller, once the vendor tells you.
The vendor's duty is to tell you. Filing with the authority and messaging people stays with the controller, so your contract should require fast, detailed incident reports.
What is the penalty ceiling for notification failures?
€10 million or 2% of worldwide annual turnover, whichever is higher.
Failures under Articles 33 and 34 fall under Article 83(4), the lower of the GDPR's two fine ceilings. Fines are set case by case by the authority.
Be ready before the clock starts.
A GDPR gap assessment includes a breach playbook and notice templates you can use at 2 a.m.