All 99 Articles Chapter 4: Controller and Processor
A personal data breach likely to risk people's rights must be reported to the supervisory authority within 72 hours of becoming aware of it. All breaches must be documented internally.
Key points
- 72-hour clock runs from awareness.
- Document every breach, even those you decide not to report.
Related articles
Practical guidance
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 33?
Our data-protection lawyers turn the text into a plan.