GDPR Article 33: Obligations, Deadlines & Penalties

The controller shall notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. Regulation (EU) 2016/679, Article 33, Article 33

If the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. Regulation (EU) 2016/679, Article 33, Article 33

The processor shall notify the controller without undue delay after becoming aware of a personal data breach. Regulation (EU) 2016/679, Article 33, Article 33

The notification to the supervisory authority shall describe the nature of the personal data breach, including categories and approximate numbers of data subjects and records concerned. Regulation (EU) 2016/679, Article 33, Article 33

The notification to the supervisory authority shall communicate the name and contact details of the data protection officer or other contact point. Regulation (EU) 2016/679, Article 33, Article 33

The notification to the supervisory authority shall describe the likely consequences of the personal data breach. Regulation (EU) 2016/679, Article 33, Article 33

The notification to the supervisory authority shall describe the measures taken or proposed to be taken by the controller to address the breach, including mitigation measures. Regulation (EU) 2016/679, Article 33, Article 33

The controller shall document any personal data breaches, comprising the facts, effects, and remedial action taken, enabling the supervisory authority to verify compliance. Regulation (EU) 2016/679, Article 33, Article 33