The GDPR 72-hour breach clock explained

What the rule says

The GDPR is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. It was published in the Official Journal on 4 May 2016 and entered into force on 24 May 2016 ¹.

Article 33(1) says the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent supervisory authority ². A notice is not needed where the breach is unlikely to result in a risk to the rights and freedoms of natural persons, according to the EDPB reading of the article ².

The 72 hours are a ceiling, not a target. The first duty is to notify without undue delay ².

When the clock starts

The trigger is awareness, not the date of the breach itself. The EDPB says a controller should be regarded as aware when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised ².

After a first alert, the controller may undertake a short period of investigation to confirm whether a breach has occurred. During that period it may not yet be regarded as aware. The EDPB says the investigation should begin as soon as possible ².

For a chronology, this means three dates matter. The date the breach happened, the date of the first alert, and the date the controller reached a reasonable degree of certainty. Only the last one starts the 72 hours ².

Processors, phases and late notices

• A processor must notify the controller without undue delay after becoming aware of a breach. The EDPB says the processor does not need to assess the likelihood of risk before it tells the controller ².
• Where all the facts are not known in time, Article 33(4) lets the information be provided in phases without undue further delay. The EDPB says the controller should tell the authority that more detail will follow ².
• A notice sent after 72 hours must come with the reasons for the delay ².
• Every breach must be documented, notified or not, so the authority can check compliance ².

Controllers outside the EU

A controller outside the EU that falls under Article 3(2) or 3(3) is still bound by Articles 33 and 34. The EDPB says the mere presence of a representative in a Member State does not trigger the one-stop-shop system. Such a controller has to notify every supervisory authority for which affected data subjects reside ².

In the United Kingdom, the retained UK GDPR keeps the 72-hour wording in Article 33(1). The legislation.gov.uk text names the Commission as the body to notify, after an amendment in force from 30 September 2026 made by S.I. 2026/386 under the Data (Use and Access) Act 2025 ³.

Telling the people affected

Article 34(1) is a separate duty. Where a breach is likely to result in a high risk to individuals, the controller shall communicate it to the data subject without undue delay ². There is no fixed hour count for this second notice in the article as quoted by the EDPB ².

How other breach clocks compare