GDPR Breach Awareness Clock

Do not start the Article 33 clock from every raw security alert. The EDPB says a controller becomes aware when it has a reasonable degree of certainty that a security incident has occurred and has led to personal data being compromised.

The controller must use that short investigation period promptly to establish whether personal data was breached, contain the incident, assess risk to individuals, and notify the supervisory authority if Article 33 is triggered. A personal data breach can affect confidentiality, integrity, or availability, so confirmed loss or destruction can trigger awareness even when unauthorized access has not been proved.

A processor that becomes aware of a personal data breach affecting personal data processed for a controller must notify the controller without undue delay. The processor does not decide the Article 33 risk threshold for the controller before escalating.

Once the processor informs the controller, the controller uses that notice to run the Article 33 assessment and, if required, notify the supervisory authority. The EDPB says the controller should in principle be considered aware once the processor has informed it of the breach. The controller keeps legal responsibility for notification even if a processor is authorised to submit a notice on its behalf.

The GDPR allows notification information to be provided in phases when it is not possible to provide all information at the same time. Exact counts are not a condition for the first notice: Article 33 allows approximate numbers of affected data subjects and records where possible. The first notice should say what is known, what is not yet known, and that more information will follow without undue further delay.

If the supervisory-authority notification is not made within 72 hours after awareness, Article 33 requires reasons for the delay. Those reasons should be specific to the breach, such as why facts could not be established sooner or why a bundled notification was used for closely related breaches.

Article 33(5) requires the controller to document personal data breaches, including the facts, effects, and remedial action. The record must allow a supervisory authority to verify compliance with Article 33.

Keep records for both notifiable and non-notifiable breaches. If the controller decides not to notify, the record should explain why the breach was unlikely to result in risk to individuals. If data subjects are not told despite likely high risk, the record should support one of Article 34(3)'s conditions: effective prior protection such as unintelligible encryption, later measures that make the high risk no longer likely to materialise, or disproportionate effort coupled with an equally effective public or similar communication.