EU/GDPR Breach Response Checklist

Yes. Article 33 requires notifying your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. The clock starts at awareness, not at full investigation. If you cannot provide every detail within 72 hours, you may notify in phases, but the initial notification should still be made on time with the information available.

A breach must be reported when it is likely to result in a risk to the rights and freedoms of individuals. Only breaches unlikely to pose any such risk are exempt, and that risk assessment must be documented either way. A breach of strongly encrypted data where the key was not compromised may not require notification, but the reasoning must be recorded.

Article 34 requires notifying affected data subjects when the breach is likely to result in a high risk to their rights and freedoms, a higher threshold than regulator notification. The communication must be in clear, plain language and describe the likely consequences and the measures taken. Direct notice can be avoided where the data was encrypted, where the risk has since been neutralised, or where individual contact would involve disproportionate effort, in which case a public communication is used instead.

Article 33(3) requires the nature of the breach, including the categories and approximate number of individuals and records affected; the contact point for more information; the likely consequences; and the measures taken or proposed to address the breach and mitigate harm. Where the information is not all available at once, it may be provided in phases without undue further delay.

Notification after 72 hours is still required, but it must be accompanied by reasons for the delay. A late or missing notification is itself a compliance failure a supervisory authority can act on, separately from the breach. Documenting why a deadline was missed is part of demonstrating accountability under Article 5(2).