Knowledge · GDPR · Article 33
72 hours to tell the authority.
A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it – unless it is unlikely to result in a risk to people.
GDPR art. 33Notification of a personal data breach
What it requires
In plain words.
- Notify the supervisory authority within 72 hours where feasible
- Explain any delay beyond 72 hours
- Processors notify the controller without undue delay
- Describe the breach, the people and data affected, consequences and measures
- Document every breach, including those not reported
Plain-language summary of GDPR Article 33 (Regulation (EU) 2016/679). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The same incident can trigger both GDPR and NIS2 reporting. One flow that asks both questions saves time when every hour counts.
- ProcessOne incident flow that assesses GDPR and NIS2 together
- FormBreach details captured once, reused in both reports
- RegisterA breach log, including breaches not reported
- EvidenceNotifications and decisions logged with who and when
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See GDPR article 33
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.