We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQEU GDPR

GDPR Breach Awareness Clock

The Article 33 supervisory-authority clock starts when the controller has a reasonable degree of certainty that a security incident has caused personal data to be compromised.

Use the first alert for triage, but keep a separate awareness record for the point when personal data breach facts become clear enough to trigger the controller's GDPR notification assessment.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
4

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

Under GDPR Article 33, a controller must notify the competent without undue delay and, where feasible, within 72 hours after becoming aware of a , unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

When does the GDPR 72-hour breach notification clock start?

Do not start the Article 33 clock from every raw security alert. The EDPB says a controller becomes aware when it has a reasonable degree of certainty that a security incident has occurred and has led to personal data being compromised.

The controller must use that short investigation period promptly to establish whether personal data was breached, contain the incident, assess risk to individuals, and notify the if Article 33 is triggered. A can affect confidentiality, integrity, or availability, so confirmed loss or destruction can trigger awareness even when unauthorized access has not been proved.

  • Record the first alert, who received it, and why it was or was not immediately enough to establish a .
  • Record the awareness timestamp separately: the point when the controller had reasonable certainty that personal data was compromised.
  • Assess whether the breach is unlikely to result in a risk to rights and freedoms; if not, prepare supervisory-authority notification without undue delay and, where feasible, within 72 hours after awareness.
  • Keep the Article 34 high-risk assessment separate from the Article 33 authority notification threshold; communication to data subjects is triggered by likely .

When does the GDPR 72-hour breach notification clock start?

The GDPR 72-hour clock starts when the controller becomes aware of a . EDPB guidance treats awareness as the point when the controller has a reasonable degree of certainty that a security incident occurred and personal data was compromised. The controller may briefly investigate an alert first, but must act promptly and notify the without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to create risk for individuals.

Citations
Regulation (EU) 2016/679 (GDPR), Article 33

Article 33 sets the controller's supervisory-authority notification duty, the 72-hour timing after awareness, the risk exception, delayed-notification reasons, processor escalation, phased information, and breach documentation duty.

Question 2

What should happen when a processor finds the breach first?

A processor that becomes aware of a affecting personal data processed for a controller must notify the controller without undue delay. The processor does not decide the Article 33 risk threshold for the controller before escalating.

Once the processor informs the controller, the controller uses that notice to run the Article 33 assessment and, if required, notify the . The EDPB says the controller should in principle be considered aware once the processor has informed it of the breach. The controller keeps legal responsibility for notification even if a processor is authorised to submit a notice on its behalf.

  • Processor record: when the processor became aware, when it notified the controller, affected services, affected personal data, and facts still unknown.
  • Controller intake record: when the controller received processor notice, whether that notice gave reasonable certainty of a , and who opened the Article 33 assessment.
  • Contract check: whether the controller-processor arrangement specifies early breach notice, phased updates, and any authority-notification support.
  • Multi-controller incident check: whether the processor must report details to each affected controller.
Citations
Question 3

What if the controller cannot complete everything within 72 hours?

The GDPR allows notification information to be provided in phases when it is not possible to provide all information at the same time. Exact counts are not a condition for the first notice: Article 33 allows approximate numbers of affected data subjects and records where possible. The first notice should say what is known, what is not yet known, and that more information will follow without undue further delay.

If the supervisory-authority notification is not made within 72 hours after awareness, Article 33 requires reasons for the delay. Those reasons should be specific to the breach, such as why facts could not be established sooner or why a bundled notification was used for closely related breaches.

  • Minimum notification content: nature of the breach, affected data-subject and record categories where possible, DPO or contact point, likely consequences, and measures taken or proposed.
  • Phased-update log: missing facts, owner for each investigation item, next update trigger, and later information sent to the .
  • Delay record: why notification exceeded 72 hours, when each material fact became available, and why the delay was not excessive.
  • Bundling check: only group similar breaches over a short period when that gives a meaningful notification; different data or breach types should be assessed separately.
Citations
Question 4

Which records prove the breach-clock decision?

Article 33(5) requires the controller to document personal data breaches, including the facts, effects, and remedial action. The record must allow a to verify compliance with Article 33.

Keep records for both notifiable and non-notifiable breaches. If the controller decides not to notify, the record should explain why the breach was unlikely to result in risk to individuals. If data subjects are not told despite likely , the record should support one of Article 34(3)'s conditions: effective prior protection such as unintelligible encryption, later measures that make the high risk no longer likely to materialise, or disproportionate effort coupled with an equally effective public or similar communication.

  • Timeline: first alert, investigation start, awareness point, risk assessment, notification decision, authority submission, phased updates, and closure.
  • Facts: breach type, cause, affected systems, affected personal data, affected data subjects, known or approximate volumes, and whether data remained intelligible.
  • Effects and risk: likely consequences, likelihood and severity assessment, high-risk data-subject communication decision, and reviewer approvals.
  • Remedial action: containment, recovery, mitigation steps, communications sent, processor updates, authority correspondence, and lessons learned.
Citations
Recommended next step

This GDPR FAQ is the control point for breach escalation

Sorena can convert the Article 33 clock, processor escalation, delay reasons, phased updates, and Article 33(5) records into a cited breach-response workflow.

Research workflow
Open Research Copilot for GDPR

Ask questions tied to cited sources about GDPR breach awareness, supervisory-authority notification, processor escalation, and evidence records.

Explore next step
Talk to Sorena
Talk through implementation

Review your GDPR personal data breach workflow, notification thresholds, and evidence gaps with Sorena.

Explore next step
Primary sources

References and citations

EDPB - How to notify a data breach to your DPA?
edpb.europa.eu
Referenced sections
  • EDPB breach-notification routing page that points controllers to national supervisory-authority notification channels without adding national procedural details to this artifact.
"How to notify a data breach to your DPA?"
EDPB Guidelines 9/2022 on personal data breach notification
edpb.europa.eu
Referenced sections
  • EDPB guidance recommends an internal breach register and documenting reasons for notification, non-notification, delayed notification, and data-subject communication decisions.
"document its reasoning for the decisions taken"
Regulation (EU) 2016/679 (GDPR), Article 33
eur-lex.europa.eu
Referenced sections
  • Article 33 sets the controller's supervisory-authority notification duty, the 72-hour timing after awareness, the risk exception, delayed-notification reasons, processor escalation, phased information, and breach documentation duty.
"not later than 72 hours after having become aware of it"
Regulation (EU) 2016/679 (GDPR), Article 33(2)
eur-lex.europa.eu
Referenced sections
  • Article 33(2) requires processors to notify controllers without undue delay after becoming aware of a personal data breach.
"The processor shall notify the controller without undue delay"
Regulation (EU) 2016/679 (GDPR), Article 33(3)-(4)
eur-lex.europa.eu
Referenced sections
  • Article 33 lists minimum notification content and permits phased information where it is not possible to provide all information at the same time.
"the information may be provided in phases"
Regulation (EU) 2016/679 (GDPR), Article 33(5)
eur-lex.europa.eu
Referenced sections
  • Article 33(5) requires documentation of personal data breach facts, effects, and remedial action so the supervisory authority can verify Article 33 compliance.
"document any personal data breaches"
Regulation (EU) 2016/679 (GDPR), Articles 33 and 34
eur-lex.europa.eu
Referenced sections
  • Primary GDPR text for controller notification within 72 hours after awareness, processor notification without undue delay, phased notification, delayed-notification reasons, breach documentation, and data-subject communication for likely high-risk breaches.
"Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay."
Related guides

Explore more topics

Does the EU GDPR apply outside the EU under Article 3?
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
EU GDPR Applicability Test for Products, Vendors, and Data Flows
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
EU GDPR Article 30 RoPA Intake Workflow
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
EU GDPR Article 6 Legal Bases FAQ
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow
Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
EU GDPR Children and Special-Category Data Guide
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
EU GDPR Controller, Processor, and Joint Controller Roles
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
EU GDPR Data Subject Rights and DSAR Workflow
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR deadlines and compliance calendar
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
EU GDPR DPIA and Prior Consultation Workflow
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA and risk management under Articles 35 and 36
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
EU GDPR DSAR Exceptions: refusal, extensions, identity checks
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
EU GDPR International Transfers and SCCs: Chapter V evidence guide
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
EU GDPR Lawful Basis and Consent Guide
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
EU GDPR Lead Supervisory Authority and One-Stop-Shop
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
EU GDPR LIA Template for Article 6(1)(f)
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties and fines: Article 83 tiers and evidence
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide
EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
EU GDPR Retention and Erasure Schedule
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
EU GDPR SCC Transfer Impact Assessment FAQ
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
EU GDPR Transfer TIA and SCC Workflow
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
EU GDPR Transparency Notices: Articles 12, 13 and 14
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
EU GDPR vs Brazil LGPD: scope, legal bases, rights, incidents, and transfers
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
EU GDPR vs California CCPA: scope, rights, opt-outs, and evidence
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
EU GDPR vs UK GDPR: Scope, Rights, Transfers, and Evidence
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
GDPR processor vs controller: role boundaries and evidence
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
GDPR vs EU AI Act: privacy controls for AI systems
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
GDPR vs EU Data Act: personal data, connected products, and access rights
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
When does the EU GDPR require a DPIA?
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.