# Notification of a personal data breach to the supervisory authority 33(2) — GDPR — provision context

> Focused context for a single provision (33(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-33#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Notification of a personal data breach to the supervisory authority** (GDPR, full article: https://overview.legal/laws/gdpr/art-33).

## Provision text

### 33(2)

The processor shall notify the controller without undue delay after becoming aware of a personal data breach.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Data Breaches** — https://overview.legal/topics/datalekken
  Security incidents involving unauthorized access to personal data
- **Notification Obligation** — https://overview.legal/topics/meldplicht
  Duty to report data breaches to authorities and affected individuals
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 19 November 2025.#Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation as a very large online platform – Plea of illegality – Admissibility – Article 33(1) and (4) of Regulation 2022/2065 – Right to respect for private and family life – Freedom to conduct a business – Right to property – Equal treatment – Freedom of expression – Da** (case-law) — https://overview.legal/posts/132131
- **Judgment of the General Court (Seventh Chamber, Extended Composition) of 19 November 2025.#Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation as a very large online platform – Plea of illegality – Admissibility – Article 33(1) and (4) of Regulation 2022/2065 – Right to respect for private and family life – Freedom to conduct a business – Right to property – Equal treatment – Freedom of expression – Da** ¶150 (case-law, General Court) — https://overview.legal/posts/132131
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** (guidance) — https://overview.legal/posts/125965
- **Guidelines 9/2022 on personal data breach notification under GDPR** (guidance) — https://overview.legal/posts/38058
- **Guidelines 07/2020 on the concepts of controller and processor in the GDPR** (guidance) — https://overview.legal/posts/38069
- **Guidelines 9/2022 on personal data breach notification under GDPR** §44 (guidance, EDPB) — https://overview.legal/posts/38058
- **Guidelines 9/2022 on personal data breach notification under GDPR** §74 (guidance, EDPB) — https://overview.legal/posts/38058
- **Guidelines 9/2022 on personal data breach notification under GDPR** §9 (guidance, EDPB) — https://overview.legal/posts/38058
- **Guidelines 9/2022 on personal data breach notification under GDPR** §138 (guidance, EDPB) — https://overview.legal/posts/38058
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §57 (guidance, EDPB) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §32 (guidance, EDPB) — https://overview.legal/posts/125965
- **Guidelines 9/2022 on personal data breach notification under GDPR** §46 (guidance, EDPB) — https://overview.legal/posts/38058

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-33#par-2 · 2026-08-22