# Notification of a personal data breach to the supervisory authority 33(1) — GDPR — provision context

> Focused context for a single provision (33(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-33#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Notification of a personal data breach to the supervisory authority** (GDPR, full article: https://overview.legal/laws/gdpr/art-33).

## Provision text

### 33(1)

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.


## Topics on this provision

- **Data Breaches** — https://overview.legal/topics/datalekken
  Security incidents involving unauthorized access to personal data
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities
- **Notification Obligation** — https://overview.legal/topics/meldplicht
  Duty to report data breaches to authorities and affected individuals
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons

## Cited by (exact-provision citations)

- **Judgment of the Court (First Chamber) of 26 September 2024.#TR v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits.#Case C-768/21.** (case-law) — https://overview.legal/posts/132245
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 19 November 2025.#Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation as a very large online platform – Plea of illegality – Admissibility – Article 33(1) and (4) of Regulation 2022/2065 – Right to respect for private and family life – Freedom to conduct a business – Right to property – Equal treatment – Freedom of expression – Da** (case-law) — https://overview.legal/posts/132131
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** (case-law) — https://overview.legal/posts/132138
- **Amsterdam Court of Appeal: Controller may reject watermarked ID copy for verification** (case-law) — https://overview.legal/posts/125642
- **Order of the General Court (Tenth Chamber) of 29 April 2025.#Meta Platforms Ireland Ltd v European Data Protection Board.#Action for annulment – Protection of personal data – Opinion of the European Data Protection Board on valid consent in the context of ‘consent or pay’ models implemented by large online platforms – Article 64(2) of Regulation (EU) 2016/679 – Act not open to challenge – Inadmissibility – Liability – Damage – Causal link – Action manifestly lacking any foundation in law.#Case T** (case-law) — https://overview.legal/posts/132144
- **Judgment of the General Court (First Chamber, Extended Composition) of 10 September 2025.#Tiktok Technology Ltd v European Commission.#Digital services – Regulation (EU) 2022/2065 – Commission decision determining the amount of the supervisory fee for 2023 – Article 43(3) to (5) of Regulation 2022/2065 – Article 4(2) of Delegated Regulation (EU) 2023/1127 – Method for calculating the number of average monthly active recipients – Temporal adjustment of the effects of an annulment.#Case T-58/24.** (case-law) — https://overview.legal/posts/132134
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** ¶139 (case-law, General Court) — https://overview.legal/posts/132138
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** ¶143 (case-law, General Court) — https://overview.legal/posts/132138
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** ¶159 (case-law, General Court) — https://overview.legal/posts/132138
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** ¶119 (case-law, General Court) — https://overview.legal/posts/132138
- **Judgment of the Court (First Chamber) of 26 September 2024.#TR v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits.#Case C-768/21.** ¶19 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132245
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23.** ¶121 (case-law, General Court) — https://overview.legal/posts/132138

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-33#par-1 · 2026-08-22