# Communication of a personal data breach to the data subject 34(4) — GDPR — provision context

> Focused context for a single provision (34(4)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-34#par-4
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Communication of a personal data breach to the data subject** (GDPR, full article: https://overview.legal/laws/gdpr/art-34).

## Provision text

### 34(4)

If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.


## Topics on this provision

- **Data Breaches** — https://overview.legal/topics/datalekken
  Security incidents involving unauthorized access to personal data
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities
- **Notification Obligation** — https://overview.legal/topics/meldplicht
  Duty to report data breaches to authorities and affected individuals
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons

## Cited by (exact-provision citations)

- **Guidelines 9/2022 on personal data breach notification under GDPR** (guidance) — https://overview.legal/posts/38058
- **EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT** (guidance) — https://overview.legal/posts/51178
- **EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT** (guidance) — https://overview.legal/posts/51076
- **EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro** (guidance) — https://overview.legal/posts/125823
- **Guidelines 9/2022 on personal data breach notification under GDPR** §99 (guidance, EDPB) — https://overview.legal/posts/38058

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-34#par-4 · 2026-08-22