A practical Article 33 and Article 34 workflow for deciding when the 72-hour supervisory-authority clock starts, what to include in the notice, and when affected people need clear high-risk communication.
Use it to align incident response, privacy, legal, data protection officer (DPO), security, processor-management, and evidence owners around awareness, risk assessment, phased updates, delay reasons, and breach logs.
A is a security breach that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Under GDPR Article 33, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of such a breach, unless the breach is unlikely to create risk for people. Article 34 adds a separate data-subject communication duty when the breach is likely to result in high risk. Identify the competent authority and verify its filing procedure before submitting the notification.
Do not start the clock from a vague security alert alone. European Data Protection Board (EDPB) Guidelines 9/2022 treat a controller as aware when it has a reasonable degree of certainty that a security incident has occurred and has led to personal data being compromised.
The initial investigation should begin as soon as possible and should be short. Once awareness exists, the controller should assess risk, contain the incident, and prepare the supervisory-authority notification where Article 33 is triggered.
Sources (2)
Article 33 sets the controller notification duty and the 72-hour benchmark after awareness.
not later than 72 hours after having become aware
The guidelines explain awareness as reasonable certainty that a security incident led to compromised personal data and distinguish preliminary investigation from later detailed investigation.
reasonable degree of certainty
Article 33 notification is required unless the is unlikely to result in a risk to the rights and freedoms of natural persons. That is a lower threshold than Article 34 communication to affected people.
Risk assessment should focus on the actual breach facts, not only the pre-incident data protection impact assessment (DPIA). Consider breach type, data sensitivity and volume, ease of identifying people, likely severity and permanence of consequences, vulnerable people, the controller's role, and the number of affected people.
Sources (3)
Article 33 requires notice unless the breach is unlikely to create risk, and Articles 55 and 56 frame competent and lead supervisory authority concepts.
unlikely to result in a risk
The guidelines list breach-risk factors and explain cross-border notification routing at a principles level.
severity of the potential impact
The EDPB breach-notification page summarizes that controllers notify the relevant DPA except for breaches unlikely to present risk, and points users to DPA notification procedures.
except for those unlikely to present any risk
A processor that becomes aware of a in processing performed for a controller must notify the controller without undue delay. The processor does not decide whether Article 33 supervisory-authority notification is required; the controller makes that risk assessment after becoming aware.
Processor contracts and incident playbooks should therefore define early escalation, facts to provide in phases, affected-controller mapping, and authority to notify on the controller's behalf only where the controller has authorized it.
Sources (2)
Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a personal data breach.
notify the controller without undue delay
The guidelines clarify that processors need not assess risk before notifying the controller and may provide details in phases.
does not need to first assess
Data-subject communication is required when the breach is likely to result in a high risk to the rights and freedoms of natural persons. This threshold is higher than the supervisory-authority notification threshold, so not every Article 33 notification requires Article 34 communication.
When Article 34 applies, the communication should be direct, clear, and useful for the affected person. It should explain the breach, the contact point, likely consequences, measures taken or proposed, and practical steps the person can take to protect themselves.
No. Article 33 supervisory-authority notification is required unless the breach is unlikely to create risk for people. Article 34 communication to affected people is triggered only when the breach is likely to result in high risk.
Not when prompt communication is needed to reduce high risk. EDPB Guidelines 9/2022 say notifying the supervisory authority is not a justification for failing to communicate with data subjects where Article 34 requires it.
Sources (2)
Article 34 requires data-subject communication for likely high-risk breaches and specifies clear-language content and exceptions.
likely to result in a high risk
The guidelines explain the higher Article 34 threshold, direct communication methods, and practical protection objective.
provide specific information about steps
Article 33(5) requires the controller to document any , including facts, effects, and remedial action, so the supervisory authority can verify compliance. This applies even when the breach is not notified.
The log should support later reconstruction of the 72-hour clock and risk decisions. It should show what the controller knew, when it knew it, why notice was or was not sent, and how follow-up facts changed the assessment.
It should prove the awareness timestamp, the Article 33 risk decision, the supervisory-authority notice or non-notification rationale, any delay reason, the Article 34 high-risk decision, communications sent, and remedial action taken.
Yes. Article 33(5) requires documentation of personal data breaches, and EDPB Guidelines 9/2022 encourage an internal breach register regardless of whether notification is required.
Sources (2)
Article 33(5) requires breach documentation covering facts, effects, and remedial action.
document any personal data breaches
The guidelines recommend documenting notification reasoning, non-notification justification, delayed notice reasons, and evidence of data-subject communications.
document its reasoning
Sorena can turn the Article 33 and Article 34 requirements on this page into a cited breach log, processor escalation checklist, supervisory-authority notice draft, high-risk data-subject communication checklist, and follow-up evidence tracker.
Ask questions tied to cited sources about the 72-hour clock, Article 33 notice content, processor escalation, Article 34 high-risk communication, and breach documentation.
Review your GDPR breach-notification workflow, source gaps, and evidence log design with Sorena.
"reasonable degree of certainty"
"severity of the potential impact"
"should not be a barrier to timely breach notification"
"does not need to first assess"
"provide specific information about steps"
"document its reasoning"
"not later than 72 hours after having become aware"
"unlikely to result in a risk"
"accompanied by reasons for the delay"
"notify the controller without undue delay"
"likely to result in a high risk"
"document any personal data breaches"
"How to notify a data breach to your DPA?"
"except for those unlikely to present any risk"
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.