# Notification of a personal data breach to the supervisory authority — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-33 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Notification of a personal data breach to the supervisory authority — Notification of a personal data breach to the supervisory authority *GDPR, gdpr-art-33-en — https://overview.legal/laws/gdpr/art-33* 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. 2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach. 3. The notification referred to in paragraph 1 shall at least: a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; c) describe the likely consequences of the personal data breach; d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. 5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. ## Enforcement 121 decision(s) on record cite Article 33, totalling approximately €34,343,143 in fines (median €20,363). Top fines: - **Vodafone Italia S.p.A.: Non-compliance with general data processing principles** (ITALY, €12,251,601) — https://overview.legal/posts/46553 - **ENDESA ENERGÍA, S.A.U.: Non-compliance with general data processing principles** (SPAIN, €6,100,000) — https://overview.legal/posts/48335 - **Fastweb S.p.A.: Non-compliance with general data processing principles** (ITALY, €4,500,000) — https://overview.legal/posts/46735 - **Carrefour France: Non-compliance with general data processing principles** (FRANCE, €2,250,000) — https://overview.legal/posts/46572 - **Postel S.p.A: Insufficient technical and organisational measures to ensure information security** (ITALY, €900,000) — https://overview.legal/posts/48589 ## Guidance ### Guidelines on processing of personal data through blockchain technologies *EDPB — https://overview.legal/posts/125668* Guidelines 02/2025 on processing of personal data through blockchain technologies Version 2.0 Adopted on 07 July 2026 1 | Adopted Version history Version Date Adoption information version 1.1 08 April 2025 adoption of the guidelines before public consultation version 2.0 07 July 2026 adoption of the guidelines after public consultation 3 | Adopted 4 | Adopted The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the… ### Template for Cross-Regulatory Cooperation Agreements *EDPB — https://overview.legal/posts/125669* 1 | Adopted Template for Cross-Regulatory Cooperation Agreements Adopted by the EDPB on July 7 th 2026 2 | Adopted Explanatory note Cross-regulatory cooperation between data protection supervisory authorities (DPAs) and other national and EU competent authorities has become increasingly important as legal and practical challenges emerge at the intersection of different regulatory fields. Cooperation agreements can be an important basis to organise and strengthen cooperation and dialogue between… ### Opinion 21/2026 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Flutter Group *EDPB — https://overview.legal/posts/125670* Opinion 21/2026 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Flutter Group Adopted on 07 July 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 20/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Fluor Group *EDPB — https://overview.legal/posts/125671* Opinion 20/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Fluor Group Adopted on 07 July 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group *EDPB — https://overview.legal/posts/125672* Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group Adopted on 08 June 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ## Related topics - **Data Breaches** — https://overview.legal/topics/datalekken ## Legal Framework - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities ## Legal Framework - **Notification Obligation** — https://overview.legal/topics/meldplicht ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-33 · 2026-08-22