# Asesora Brecha: must this breach be notified? (AEPD)

- Type: Tools
- Source: AEPD
- Date: 2026-11-11
- Original: https://www.aepd.es/en/guides-and-tools/tools/asesora-brecha
- Canonical: https://overview.legal/posts/623976
- Topics: Data Breaches, Notification Obligation, Supervision, Supervisory Authorities, Personal Data, Controllers

## Summary

A short decision aid of the Spanish DPA: answer questions about a personal data breach and it says whether the breach must be notified to the supervisory authority under Article 33. Its companion Comunica-Brecha covers informing the people affected.

## Full text

A short decision aid of the Spanish DPA: answer questions about a personal data breach and it says whether the breach must be notified to the supervisory authority under Article 33. Its companion Comunica-Brecha covers informing the people affected.

When to use it: A breach has just happened and you must decide within 72 hours whether to notify.
Provisions: GDPR Art. 33.
Published by AEPD (supervisory authority), for Spain.
For: controllers, DPOs and privacy officers.
Free; available in Spanish, English.

Korte beslishulp van de Spaanse toezichthouder: beantwoord vragen over een datalek en hij zegt of het lek op grond van artikel 33 bij de toezichthouder gemeld moet worden. De bijbehorende Comunica-Brecha gaat over het informeren van de betrokkenen.

Wanneer gebruiken: Er is net een datalek en je moet binnen 72 uur beslissen of je meldt.

---
Generated by overview.legal · https://overview.legal/posts/623976 · 2026-11-14