GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

Article 33 — Supervisory Authority

• Trigger: personal data breach (Art 4(12))
• Timing: without undue delay and where feasible within 72 hours of becoming aware
• If late: explain the reasons for the delay
• Content: nature of breach, categories/approximate numbers, DPO/contact, likely consequences, measures taken/proposed
• Phased notifications allowed when information arrives in stages
• Document every breach, including those not notified (Art 33(5))

Article 34 — Data Subjects

• Required when the breach is likely to result in a high risk to rights and freedoms
• Clear, plain language describing nature, DPO/contact, likely consequences, measures
• Exceptions exist (e.g. appropriate technical protection such as encryption rendering data unintelligible; subsequent measures; disproportionate effort with public communication)

Operational Steps

1. Detect & contain
2. Confirm personal data involvement → mark “aware”
3. Risk assess (SA notify vs subject communicate)
4. Notify SA within 72 hours where required
5. Communicate to subjects if high risk
6. Remediate and retain the incident file

Processors

Under Article 33(2), processors notify the controller without undue delay after becoming aware. Controllers remain responsible for SA/subject notifications.

How CyberSilo Helps

• ThreatHawk shortens time-to-awareness with correlated detection
• CSA stores timelines, risk assessments, and notification packages

Frequently Asked Questions

What is the GDPR breach notification deadline?

Notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware (Article 33).

When must we tell individuals?

When the breach is likely to result in a high risk to their rights and freedoms (Article 34), subject to listed exceptions.

Do encrypted breaches need SA notice?

Risk may be reduced if data are unintelligible to unauthorised persons, but document the assessment; Art 33(5) still requires internal documentation.

Related GDPR Resources

GDPR hub · SIEM logs · GCC breach matrix · CSA