What is GDPR Article 33? The 72-hour breach notice to a supervisory authority, defined

GDPR Article 33 is the provision of the EU General Data Protection Regulation (GDPR) that requires a data controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. It does not apply when the breach is unlikely to result in a risk to people's rights and freedoms.

What the article requires

The Regulation, which applies from 25 May 2018, defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Under Article 33, a notice filed after 72 hours must give reasons for the delay. Processors must tell their controller without undue delay.

The notice must describe the breach, including where possible the approximate number of people and records concerned, give a contact point such as the data protection officer, and set out likely consequences and the measures taken. Information can follow in phases. Every breach must be documented, notified or not, so the authority can verify compliance.

When the clock starts

The text runs the 72 hours from "after having become aware of it", so the start date turns on that phrase. The European Data Protection Board, in guidelines adopted on 28 March 2023, treats a controller as aware once it has a reasonable degree of certainty that a security incident has led to personal data being compromised. Controllers outside the EU that fall under the Regulation remain bound by Articles 33 and 34.

How it is enforced

Infringing a controller's obligations under Articles 25 to 39, which include Article 33, can draw administrative fines of up to €10,000,000 or 2% of worldwide annual turnover, whichever is higher. On 15 December 2020 Ireland's Data Protection Commission fined Twitter €450,000 for infringing Article 33(1) and 33(5): late notification and inadequate documentation.

What it is not

Article 33 is notice to the regulator. Telling the people affected is Article 34, required when a breach is likely to result in a high risk to them. Neither is a US breach notification law, and an incident at an essential or important entity can also be a NIS2 significant incident with its own clock.

Where it appears on cisonews.net

This record is built mainly from US filings and notices; the state-by-state notification guide is the closest comparison, and the incident log shows how US filers describe the same kinds of events.