GDPR Breach Notification Requirements: Timelines, Scope and Compliance Steps
The 72-hour clock starts when you know of the breach, not when you finish your internal investigation or determine the full scope.
You must report personal data breaches to the supervisory authority within 72 hours of awareness. If the breach poses a high risk to individuals, you must also notify them without undue delay. The rule applies to all organizations processing EU resident data, regardless of physical location.
The Leak in the Bucket
Imagine a water pipe bursting in your basement. You do not wait to calculate the exact volume of water lost before calling the plumber. You call immediately to stop the flow. The GDPR breach notification rule operates on this same principle of immediate containment signaling. It requires organizations to alert regulators quickly so that systemic risks can be managed. Speed matters more than perfection in the initial report.
This rule defines a breach as any incident compromising the confidentiality, integrity or availability of personal data. The focus is on the impact to individuals, not just the technical failure. You must distinguish between a mere security event and a breach of personal data. A server crash that deletes backups is an availability issue. If that server held customer records, it is a breach.
GDPR Breach Notification Requirements
The GDPR breach notification requirements center on three distinct obligations: reporting to the authority, notifying affected individuals and maintaining internal records. The timeline is the most critical component. You have 72 hours from the moment you become aware of the breach to inform the relevant supervisory authority. This clock does not pause for internal debates or legal reviews.
The requirement applies to any organization processing personal data of individuals in the European Union. This includes companies outside the EU that offer services to EU residents or monitor their behavior. The scope is broad because the regulation protects the data subject, not the location of the processor. You cannot ignore these rules based on your headquarters location.
| Aspect | Detail |
|---|---|
| Reporting Deadline | 72 hours from awareness of the breach |
| Recipient | Competent supervisory authority in the EU member state |
| Individual Notification | Required only if the breach poses a high risk to rights and freedoms |
| Documentation | Mandatory for all breaches, kept for at least 4 years |
| Content of Report | Nature of breach, categories of data, approximate number of records |
Who Must Comply
The obligation falls on both data controllers and data processors. A controller determines the purposes and means of processing data. A processor acts on behalf of the controller. If you are a processor, you must notify the controller without undue delay after becoming aware of a breach. The controller then decides whether to notify the authority and the individuals.
This distinction matters for cloud providers and third-party vendors. They often detect the initial sign of compromise. Their contract with the controller usually mandates immediate alerting. Delays by the processor can shift liability to them. You must review your vendor agreements to ensure they align with the 72-hour window.
How to Execute the Response
Step 1 is immediate containment. Stop the bleeding by isolating affected systems. Step 2 is assessment. Determine what data was exposed and to whom. Step 3 is notification. Prepare the report for the supervisory authority. Do not wait until you have every detail. The initial report can be preliminary. You may provide additional information in stages as you learn more.
The report must include the nature of the breach, the categories and approximate number of data subjects concerned, and the likely consequences. You must also describe the measures taken to address the breach. If you cannot provide all details within 72 hours, you must explain the reasons for the delay. The authority accepts phased reporting as long as the initial alert is timely.
What People Usually Get Wrong
Many teams believe they have more time than they do. The misconception is that the 72 hours starts when the investigation concludes. This is false. The clock starts when you reasonably should have known about the breach. Ignoring alerts or delaying triage does not reset the timer. It counts against you.
Another common error is assuming that technical fixes eliminate the need for notification. Patching a vulnerability or resetting passwords does not erase the fact that data was exposed. You must report the breach regardless of whether you prevented further damage. The regulator needs to know about the incident to track trends and enforce accountability.
See also: Password Reuse Prevention Checklist for Secure Identity Management
Risk Assessment for Individuals
Not every breach requires notifying the affected people. You must notify individuals only if the breach is likely to result in a high risk to their rights and freedoms. Low-risk breaches, such as the loss of encrypted data that cannot be decrypted, do not require individual notification. You must document this decision and the rationale behind it.
High risk includes scenarios where data could lead to identity theft, discrimination or financial loss. Unencrypted health records, financial data or biometric information usually trigger this requirement. The notification to individuals must be clear and plain. Avoid legal jargon. Tell them what happened, what data was involved and what steps they should take to protect themselves.
Documentation and Forensics
You must record every personal data breach, whether or not it is reported to the authority. This record must include the facts relating to the breach, its effects and the remedial actions taken. You keep this documentation for at least 4 years. Regulators may request these logs during audits or investigations.
This documentation supports your defense in case of a dispute. It proves you acted diligently. It also helps improve your security posture over time. You should integrate this logging into your digital forensics process. Ensure that your incident response plan includes a step for updating the breach register. Consistency here demonstrates compliance culture.
Long-Term Compliance Strategy
Compliance is not a one-time task. It is a continuous cycle of improvement. You must test your notification procedures regularly. Conduct tabletop exercises that simulate a breach scenario. Measure how long it takes to detect, assess and report. Identify bottlenecks in your communication chain.
Review your third-party risk management. Ensure your vendors understand their obligations. Update your incident response plan to reflect new threats. Stay informed about guidance from supervisory authorities. They publish best practices and enforcement trends. Aligning with these expectations reduces your risk of non-compliance.
The Bottom Line
Speed is your primary defense in a data breach scenario. You must prioritize immediate reporting to the supervisory authority within 72 hours of awareness. Do not wait for full forensic clarity before making the initial call. This proactive approach demonstrates accountability and mitigates regulatory penalties.
Key takeaways
- The 72-hour deadline triggers on awareness, not on full forensic completion.
- Direct notification to affected individuals is only mandatory when high risk exists.
- Documentation is required for every breach, even those that do not trigger external reporting.
The 72-hour clock starts at awareness, not at resolution, so prioritize immediate regulatory notification over perfect internal clarity. Update your incident response plan to include automated logging and clear vendor notification protocols to ensure consistent compliance.
Frequently asked questions
Does a breach of non-personal data trigger the 72-hour rule?
No. The GDPR only applies to personal data. If the breached data does not identify or relate to an individual, you do not need to report it to the supervisory authority.
Can I delay notification to gather more facts?
You can provide a partial report if you lack details, but you must notify within 72 hours. You must explain why information is incomplete and provide updates as soon as they are available.
What if the breach was caused by a third-party vendor?
The vendor must notify you without undue delay. You, as the controller, are responsible for notifying the authority and affected individuals. Your contract should define these timelines clearly.
How long must I keep breach records?
You must maintain documentation of all personal data breaches for at least 4 years. This includes breaches that did not require notification to the authority or individuals.
How this guide was produced: written by the RedTeam Monitor editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
