GDPR 72-hour breach notification: how the clock works

You must notify your data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk. You can send what you know first and add details later.

What Article 33 says

In case of a personal data breach, the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it. The exception: you do not have to notify when the breach is unlikely to result in a risk to the rights and freedoms of people. If you notify after 72 hours, the notification must come with the reasons for the delay [1][2].

Three details matter:

"Without undue delay" comes first. 72 hours is the outer limit where feasible, not a target. If you have the facts on day one, notify on day one.
The clock is in hours, not working days. A breach found on Friday afternoon has a deadline on Monday afternoon.
Processors do not have their own 72 hours to the authority. A processor must inform the controller without undue delay after becoming aware of a breach [1]. The controller's clock is what counts.

When does the clock start?

The clock starts when you become aware, not when the breach happened. The EDPB says a controller should be regarded as aware when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised [3].

The guidelines accept that you may need a short investigation after a first alert to establish whether a breach really happened, and you may not be regarded as aware during that period. But you are expected to investigate promptly [3]. In practice this means: do not let a suspected incident sit in a queue. Start the assessment the same day and write down when certainty arrived.

Some cases are clear from the start. In the EDPB examples, when a third party tells you it received someone's personal data by mistake and gives evidence of it, there is no doubt about awareness [3].

Worked example: counting the hours

An invented example. On Tuesday at 09:10 a staff member reports that a shared drive link to a folder of job applications was public. At 11:30 the IT lead confirms from access logs that the folder was opened from unknown addresses.

Alert received: Tuesday 09:10. Not yet certain, investigation starts at once.
Aware: Tuesday 11:30, logs confirm access to personal data.
Deadline: Friday 11:30, 72 hours later.
If the notification goes in on Friday at 15:00, it is late and must include the reasons for the delay.

Write both times in your breach register, together with what you did between them. That record is your evidence of when the clock started.

What the notification must contain

Article 33(3) lists the minimum content [1]:

The nature of the breach, including where possible the categories and approximate number of people concerned and the categories and approximate number of records concerned.
The name and contact details of the data protection officer or another contact point.
The likely consequences of the breach.
The measures taken or proposed to address the breach, including, where appropriate, measures to reduce its possible adverse effects.

The EDPB notes this is a minimum and you can add more details where needed [3].

You do not need all the facts: notify in phases

Where it is not possible to provide all the information at the same time, Article 33(4) allows you to provide it in phases without undue further delay [1]. So the honest answer to "we do not know everything yet" is to notify what you know within 72 hours, say what you are still investigating, and send updates. Waiting for a complete picture and missing the deadline is the worse option.

INITIAL NOTIFICATION (phase 1)

Organisation and contact point: 
Our reference:                  
Date and time we became aware:  
Date and time of breach:        (or "still under investigation")
Nature of breach:               confidentiality / integrity / availability
What happened (short):          
Categories of people, approx. number:  
Categories of data, approx. number of records: 
Likely consequences:            
Measures taken:                 
Measures proposed:              
People affected informed?       yes / no / planned, date:
Still under investigation:      
Next update expected:           
Reasons for delay (if after 72 hours):

Most authorities have their own online form, and the fields differ by country. Use this as a draft to copy into the form, not as a replacement for it.

Which authority?

You notify the competent supervisory authority [1]. Which one that is depends on where you are established and where the processing takes place. When in doubt, check your national authority's website.

When you do not need to notify

Only when the breach is unlikely to result in a risk to people [1]. The EDPB's ransomware examples show how this works: a ransomware attack with a good backup, quick restoration and no sign of data leaving the network was still treated as a case to document, and the result depends on the facts [4]. If you decide not to notify, document the breach and your reasons anyway. Article 33(5) requires that for every breach [1].

A 72-hour checklist

Hour 0: record the time you became aware.
First hours: contain the breach. Change passwords, revoke links, isolate systems.
Same day: collect facts: what data, how many people, which systems.
Day 1 to 2: assess risk to people and decide: notify or not, and tell people or not. See when to notify individuals.
Before hour 72: submit the notification, partial if needed, and save the confirmation.
After: send updates as facts come in and complete the register entry.

What is at stake

Breaches of Articles 33 and 34 fall under Article 83(4): administrative fines up to 10 million euros or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding year, whichever is higher [5]. That is a maximum, not a standard amount.

Comparing options? See spreadsheet vs tool vs consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.