GDPR Recital 88 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this law. Contains: the full text of every article, recital and provision of this law. Everything links back to its source on overview.legal — legal information, not advice.

Recital 88 — personal data breach notification rules

Data Breaches Notification Obligation Personal Data Legitimate Interest Lawful Basis Supervision
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse. Moreover, such rules and procedures should take into account the legitimate interests of law-enforcement authorities where early disclosure could unnecessarily hamper the investigation of the circumstances of a personal data breach.

Related across sources

Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) Guidance Guidelines 9/2022 on personal data breach notification under GDPR Guidance Guidelines 06/2022 on the practical implementation of amicable settlements Enforcement NAIH fines online store HUF 2M for unclear and incomplete privacy notice Guidance EDPB Annual Report 2025 Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation