A practical Article 33 and Article 34 workflow for deciding when the 72-hour supervisory-authority clock starts, what to include in the notice, and when affected people need clear high-risk communication.
Use it to align incident response, privacy, legal, DPO, security, processor-management, and evidence owners around awareness, risk assessment, phased updates, delay reasons, and breach logs.
Structured answer sets in this page tree.
Cited legal and guidance references.
Under GDPR Article 33, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to create risk for people. Article 34 adds a separate data-subject communication duty when the breach is likely to result in high risk. This guide turns those duties into an incident workflow without adding unsupported national procedures.
Do not start the clock from a vague security alert alone. EDPB Guidelines 9/2022 treat a controller as aware when it has a reasonable degree of certainty that a security incident has occurred and has led to personal data being compromised.
The initial investigation should begin as soon as possible and should be short. Once awareness exists, the controller should assess risk, contain the incident, and prepare the supervisory-authority notification where Article 33 is triggered.
Article 33 notification is required unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. That is a lower threshold than Article 34 communication to affected people.
Risk assessment should focus on the actual breach facts, not only the pre-incident DPIA. Consider breach type, data sensitivity and volume, ease of identifying people, likely severity and permanence of consequences, vulnerable people, the controller's role, and the number of affected people.
A processor that becomes aware of a personal data breach in processing performed for a controller must notify the controller without undue delay. The processor does not decide whether Article 33 supervisory-authority notification is required; the controller makes that risk assessment after becoming aware.
Processor contracts and incident playbooks should therefore define early escalation, facts to provide in phases, affected-controller mapping, and authority to notify on the controller's behalf only where the controller has authorized it.
Data-subject communication is required when the breach is likely to result in a high risk to the rights and freedoms of natural persons. This threshold is higher than the supervisory-authority notification threshold, so not every Article 33 notification requires Article 34 communication.
When Article 34 applies, the communication should be direct, clear, and useful for the affected person. It should explain the breach, the contact point, likely consequences, measures taken or proposed, and practical steps the person can take to protect themselves.
No. Article 33 supervisory-authority notification is required unless the breach is unlikely to create risk for people. Article 34 communication to affected people is triggered only when the breach is likely to result in high risk.
Not when prompt communication is needed to reduce high risk. EDPB Guidelines 9/2022 say notifying the supervisory authority is not a justification for failing to communicate with data subjects where Article 34 requires it.
Article 33(5) requires the controller to document any personal data breach, including facts, effects, and remedial action, so the supervisory authority can verify compliance. This applies even when the breach is not notified.
The log should support later reconstruction of the 72-hour clock and risk decisions. It should show what the controller knew, when it knew it, why notice was or was not sent, and how follow-up facts changed the assessment.
It should prove the awareness timestamp, the Article 33 risk decision, the supervisory-authority notice or non-notification rationale, any delay reason, the Article 34 high-risk decision, communications sent, and remedial action taken.
Yes. Article 33(5) requires documentation of personal data breaches, and EDPB Guidelines 9/2022 encourage an internal breach register regardless of whether notification is required.
Sorena can turn the Article 33 and Article 34 requirements on this page into a cited breach log, processor escalation checklist, supervisory-authority notice draft, high-risk data-subject communication checklist, and follow-up evidence tracker.
Ask source-linked questions about the 72-hour clock, Article 33 notice content, processor escalation, Article 34 high-risk communication, and breach documentation.
Review your GDPR breach-notification workflow, source gaps, and evidence log design with Sorena.
"except for those unlikely to present any risk"
"document its reasoning"
"document any personal data breaches"