GDPR breach notification explained

Two separate duties

Article 33 covers notice to the supervisory authority ¹. The controller must notify without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. A notice made after 72 hours must give reasons for the delay ¹.

Article 34 covers notice to the people affected ¹. It applies when the breach is likely to result in a high risk to the rights and freedoms of natural persons ¹. The ICO guide for the UK uses the same 72-hour and high-risk tests ⁴.

A processor that suffers a breach must notify the controller without undue delay after becoming aware of it ¹.

What the notice must contain

Article 33(3) lists the minimum content ¹.

• The nature of the breach, including approximate categories and numbers of people and records ¹.
• The name and contact details of the data protection officer or another contact point ¹.
• The likely consequences of the breach ¹.
• The measures taken or proposed to address the breach and limit its effects ¹.
• Where the facts are not all known, the information may be provided in phases without undue further delay ¹.

When individuals must be told

The message to individuals must describe the breach in clear and plain language, with the contact point, likely consequences and measures taken ¹. Article 34(3) sets three cases where it is not required ¹.

• The data was protected, for example by encryption that makes it unintelligible to unauthorised persons ¹.
• Later measures mean the high risk is no longer likely to materialise ¹.
• Individual notice would involve disproportionate effort. A public communication must then reach people equally well ¹.

Enforcement of the notice rules

On 17 December 2024 the Irish DPC announced fines totalling €251 million against Meta over a 2018 Facebook breach ². The total included €8 million under Article 33(3) for a notice that left out information Meta could and should have included, and €3 million under Article 33(5) for poor breach records ². The remaining €240 million related to data protection by design and default ². The DPC said no objections were raised to its draft decision under Article 60 ².

The CNIL fined a private hospital €500,000 in a decision dated 21 July 2026 ⁵. It found that only some patients were told and that 202,246 people listed as trusted third parties received no direct notice, in breach of Article 34 ⁵.

Article 83(4) sets a maximum of €10 million or, for an undertaking, 2% of total worldwide annual turnover, whichever is higher, for breaches of Articles 25 to 39, the range that includes Articles 33 and 34 ³.

How many notices regulators receive

The DPC received 6,521 valid breach notifications in 2025, a 16% fall on 2024, and concluded 85% of them by year end ⁶. It said almost half resulted from correspondence sent to the wrong recipient ⁶.