Contents
- Short answer
- What is a personal data breach?
- Careful decision sequence
- Art. 33 and Art. 34 compared
- Step by step
- When no notification to the authority is needed
- What do the 72 hours mean?
- When communication to affected people may not be required
- Document every breach
- If the breach happens at a service provider
- Checklist
- Common mistakes
- Frequently asked questions
- Sources
Short answer
Not every data breach has to be notified. Under Art. 33 GDPR you notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it – unless it is unlikely to result in a risk to the rights and freedoms of natural persons. Under Art. 34 you inform the affected people themselves only where the breach is likely to result in a high risk. Every breach must be documented, even when no notification is required.
What is a personal data breach?
Definition in Art. 4(12) GDPR
In essence: a breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, or to its unauthorised disclosure or access.
Typical examples
A lost unencrypted laptop with customer data, an email with HR data sent to the wrong recipient, a compromised mailbox or encrypted servers after ransomware. Whether notification is required follows only from the risk assessment.
Not only cyberattacks
Misdirected mail, loss or a folder accidentally shared publicly can also be a breach. Conversely, not every IT security incident is a personal data breach – what matters is whether personal data is affected.
Careful decision sequence
- 1
Is there a personal data breach?
Has personal data been lost, destroyed, altered, disclosed or accessed without authorisation?
- 2
Which data is affected?
For example contact details, payment data, health data, credentials or HR records.
- 3
Which people are affected?
Customers, employees, children – roughly how many?
- 4
What consequences are possible?
For example identity theft, financial loss, discrimination, reputational damage or loss of control over personal data.
- 5
Which protections were effective?
Was encryption actually active, and was the key not affected?
- 6
Is there a risk?
If yes or unclear: consider notification to the authority under Art. 33.
- 7
Is there a high risk?
If yes: also consider communication to data subjects under Art. 34, including the exceptions.
- 8
Check notifications and communications
Identify the competent authority; involve your data protection officer, insurer or legal advice if needed.
- 9
Document the decision
A reasoned decision not to notify also belongs in the documentation.
Art. 33 and Art. 34 compared
| Art. 33 – notification to the authority | Art. 34 – communication to data subjects | |
|---|---|---|
| Threshold | Risk to the rights and freedoms of natural persons | Likely high risk |
| Exception | No notification if the breach is unlikely to result in a risk | May not be required under the conditions in Art. 34(3) (see below) |
| Timing | Without undue delay and, where feasible, within 72 hours of awareness | Without undue delay |
| Who | The controller | The controller |
Step by step
- 01
Contain the incident
Stop further data loss: block access, change passwords, ask misdirected recipients to delete. Technical first steps are covered in the cyberattack guide.
- 02
Record the time
Note when you became aware of the breach. The Art. 33 period runs from then.
- 03
Involve the right people
Inform your data protection officer, if you have one, and management.
- 04
Assess the risk
Work through the decision sequence. The EDPB guidelines and the German DSK short paper no. 18 offer orientation.
- 05
Notify where required
Most authorities provide an online form. In Germany, the competent authority is usually the state data protection authority where your company is based.
- 06
Follow up
Record what helped and what was missing, and update your incident plan.
When no notification to the authority is needed
The duty under Art. 33 does not apply where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This exception is part of the rule – but you must be able to justify and document your assessment. If in doubt, seek qualified advice, for example from your data protection officer.
What do the 72 hours mean?
- The period starts when the controller becomes aware of the breach – not when the original attack or error happened.
- Notification should happen without undue delay; 72 hours is the upper limit in the normal case (“where feasible”), not a buffer.
- If notification is made after 72 hours, it must be accompanied by reasons for the delay (Art. 33(1)).
- Where not all information is available at once, it may be provided in phases without undue further delay (Art. 33(4)).
When communication to affected people may not be required
Under Art. 34(3), communication to data subjects is not required if one of the following conditions is met. This does not mean encrypted data never matters – the condition must actually apply in the specific case.
Effective protection measures
Appropriate technical and organisational measures were applied to the affected data that render it unintelligible to unauthorised persons – such as encryption whose key was not also compromised.
Subsequent measures
The controller has taken subsequent measures ensuring that the high risk is no longer likely to materialise.
Disproportionate effort
Individual communication would involve disproportionate effort. In that case, a public communication or similarly effective measure is required instead.
Document every breach
Under Art. 33(5), the controller documents any personal data breach, including the facts, its effects and the remedial action taken. This also applies to breaches you do not notify. Record at least:
- What happened, when, and when did you become aware?
- Which data and which groups of people are affected?
- What consequences are possible?
- Which measures were taken?
- How was the risk assessed – and why did you notify or not?
If the breach happens at a service provider
If a provider processes personal data on your behalf (processor), it must notify you without undue delay after becoming aware of a breach (Art. 33(2)). Notifying the authority remains the controller’s task. Agree in your data processing agreement how and through which contact you will be informed.
Checklist
- The time of awareness is recorded.
- Affected data and groups of people are listed.
- Risk and high risk were assessed separately.
- The competent authority and its reporting channel are known.
- Providers are contractually required to report breaches without undue delay.
- Every breach is documented – even without notification.
Common mistakes
- Assuming every breach must automatically be notified within 72 hours.
- Conversely, assuming a minor breach never has to be documented.
- Starting the clock only once the internal investigation is complete.
- Waiting until every detail is known instead of providing information in phases.
- Treating encryption as an exception without checking it was effective.
Frequently asked questions
Must every breach be notified within 72 hours?
No. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. You should justify and document that assessment.
When do the 72 hours start?
When the controller becomes aware of the breach – not when the original attack happened.
What if we don’t have all the information yet?
Under Art. 33(4), information may be provided in phases where it cannot be provided at the same time.
Do we always have to inform affected people?
No. Art. 34 requires a likely high risk and has exceptions. The threshold is higher than for notifying the authority.
The breach happened at our provider – who notifies?
The provider informs you, as controller, without undue delay. Whether and how to notify is your decision and responsibility.
Sources
- EUR-Lex – Regulation (EU) 2016/679 (GDPR), Art. 4(12), Art. 33, Art. 34
- EDPB – Guidelines 9/2022 on personal data breach notification under GDPR (Version 2.0, 2023)
- Datenschutzkonferenz (DSK) – Kurzpapiere, u. a. Nr. 18 „Risiko für die Rechte und Freiheiten natürlicher Personen“
Checked on 7 October 2026.
Whether a data breach must be notified depends on the specific facts. This information is for general guidance and does not replace individual legal or data protection advice.