GDPR's 72-Hour Breach Notification Rule, Explained

The core rule

GDPR Article 33 says a data controller must tell the proper authority about a personal data breach without delay and, where possible, within 72 hours of learning of it. This holds unless the breach is unlikely to harm people's rights. This is the binding rule today. A proposal to stretch the window to 96 hours is still moving through the EU law machine. It is not law yet.

Missing the 72-hour deadline is its own separate offense. You can be fined for a late report even if your breach response itself was handled well.

When the clock actually starts

Most groups get this wrong. The clock starts at awareness. EDPB guidance says awareness means the point where you have a fair degree of certainty that personal data was hit. Not the end of your investigation. Not when you know the full scope. Not when legal signs off on the wording. A security alert that turns out to be a real compromise starts the clock at the point of fair certainty. That point often comes well before the probe is done.

Cannot nail down every fact inside 72 hours? GDPR plans for that. Article 33(4) allows phased notice. You report what you know inside the window. Then you add more as you learn it. You do not wait for the full picture before saying anything.

Two separate duties, not one

Not every breach that trips Article 33 also trips Article 34. The Article 34 bar is high harm, not just some harm. Check which bar your incident has crossed. One notice does not cover both duties.

What starts the duty, and what does not

You must report when the breach is likely to harm people's rights. A breach that was fully contained with no real exposure, say, an encrypted laptop with no sign the encryption was broken, may not cross the bar. But you must write that call down at the time, the same way a HIPAA risk check is written down. Do not rebuild the record later if a regulator asks why you stayed quiet.

Are you a processor rather than a controller? Article 33(2) makes you tell the controller without delay once you learn of the breach. The controller's 72-hour clock in effect starts against your notice to them, not against whenever you got around to telling them.

What is changing, and what has not changed yet

The EU's "Digital Omnibus" proposal is working through the law process during 2026. It seeks to stretch the notice window from 72 to 96 hours. It also seeks one single entry point that would merge several separate EU cyber-reporting duties into one channel. As of the latest tracked status, the proposal sits at the "awaiting committee decision" stage. The current 72-hour rule is still the binding law. Build your IR plan against the current 72-hour standard. Treat the 96-hour idea as worth watching, not worth planning around yet.

What this means for your IR plan

• Define "awareness" before an incident, not during one. Your IR plan should name who has the power to say the company "has learned" of a breach. Leave this fuzzy and hours vanish into internal debate about when the clock began.
• Draft a phased-notice template in advance. Article 33(4) lets you report with partial facts. Have a template ready. It covers what is known, what is still being checked, and a promise to update. Do not write this in hour 60.
• Track Article 33 and Article 34 bars apart. The authority notice and the people notice are different calls. They have different harm bars and go to different places.
• Check your retainer firm for real GDPR notice work. That includes knowing your authority's specific reporting portal and its expected format.