GDPR Breach Notification: The 72-Hour Rule Step by Step

What counts as a personal data breach

Article 4(12) GDPR defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed". It is broader than a hack: a lost laptop, an email sent to the wrong recipients, ransomware that makes data unavailable, or a misconfigured cloud bucket can all qualify.

The decision in one table

Risk to people	Notify the authority?	Tell the people affected?	Document it?
Unlikely to result in a risk	No	No	Yes, always (Art. 33(5))
Risk	Yes, within 72 hours (Art. 33(1))	No	Yes
High risk	Yes, within 72 hours	Yes, without undue delay (Art. 34(1)), unless an exception applies	Yes

Step 1: Contain the breach and establish the facts

Stop the leak first: revoke access, recall the email, isolate the system, change credentials. Then gather what you know: what data, whose data, how many people, how it happened and whether it is still happening. Write it down as you go; you will need it for the notification and for your breach record.

Step 2: Work out when the 72 hours started

The 72 hours run from when the controller became aware of the breach (Article 33(1)), not from when the breach happened. In its Guidelines 9/2022, the EDPB explains that a controller is aware once it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. A short investigation to establish whether a breach has actually happened is acceptable, but it should start promptly.

If a processor discovers the breach, it must notify you without undue delay (Article 33(2)). According to the EDPB, you are in principle aware once your processor has told you.
Record the moment you became aware and why. If you notify later than 72 hours, the notification must explain the reasons for the delay (Article 33(1)).

Step 3: Assess the risk to the people affected

Notification depends on the risk to individuals' rights and freedoms, not on the size of the incident. Consider the type of data (health, financial and other sensitive data weigh heavily), how easily people can be identified, the possible consequences (identity theft, fraud, discrimination, distress), how many people are affected, and whether they are vulnerable, such as children. Encrypted data whose key was not compromised usually carries little risk to confidentiality.

Estimate the stakes: our free Breach Cost Calculator estimates a fine range under the EDPB's fining method and adds your own response costs.

Step 4: Notify the supervisory authority

Notify the authority that is competent under Article 55, normally through its online breach form. Article 33(3) sets the minimum content:

The notification must	Article
Describe the nature of the breach, including where possible the categories and approximate number of people and of records concerned	33(3)(a)
Give the name and contact details of the DPO or another contact point	33(3)(b)
Describe the likely consequences	33(3)(c)
Describe the measures taken or proposed, including measures to mitigate possible adverse effects	33(3)(d)

You do not need complete information to notify. Where it is not possible to provide everything at once, you can provide it in phases without undue further delay (Article 33(4)). Notify on time with what you know and follow up.

Organisations without an establishment in the EU cannot use the GDPR's one-stop-shop. Under the EDPB's updated guidelines (version 2.0), they must notify the authority in every member state where affected people live.

Step 5: Tell the people affected if the risk is high

When the breach is likely to result in a high risk, you must communicate it to the people affected without undue delay (Article 34(1)), in clear and plain language. The communication must describe the nature of the breach and contain at least the contact point, the likely consequences and the measures taken or proposed (Article 34(2)). Practical advice helps, for example to change passwords or watch for phishing.

Article 34(3) sets out three exceptions:

The data was protected by measures that make it unintelligible to anyone not authorised to access it, such as encryption.
You have taken subsequent measures that ensure the high risk is no longer likely to materialise.
Contacting people individually would involve disproportionate effort. You must then use a public communication or a similar, equally effective measure.

The authority can still require you to inform people if it considers the risk high (Article 34(4)).

Step 6: Document every breach

Article 33(5) requires you to document every personal data breach, including those you decided not to notify: the facts, the effects and the remedial action. Record your risk assessment and the reasons for your decisions, so the authority can verify your compliance. A breach register makes this routine.

Other reporting duties that may apply

NIS2: if you are an essential or important entity, a significant incident needs an early warning to your CSIRT or authority within 24 hours. See our NIS2 incident reporting guide.
DORA: financial entities report major ICT-related incidents to their financial supervisor on DORA's own timeline.
Contracts, insurers and the police may also need to be told. These duties run in parallel; one report does not replace another.

Have the forms ready before you need them. The GDPR Data Breach Response Toolkit includes a 72-hour notification checklist, a breach impact assessment matrix, a breach register, letter templates for the authority and for the people affected, and a lessons-learned template.