Data Breaches

Legal Framework

The GDPR defines the concept of a personal data breach in Article 4(12):

"'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;"
— GDPR Art. 4(12)

This definition is deliberately broad. It captures not only external cyberattacks but also accidental loss of devices, misdirected emails, and internal misconfigurations — any security failure affecting personal data, whether intentional or not.

Two articles govern the operational response. Article 33 imposes a dual notification duty: the controller must notify the competent supervisory authority, and the processor must notify the controller. The controller's notification to the authority must occur without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the 72-hour window is missed, the notification must include reasons for the delay. The notification must describe the nature of the breach, the likely consequences, and the measures taken or proposed. Where full information is not yet available, it may be provided in phases. Article 33(5) additionally requires controllers to document all breaches — the facts, effects, and remedial actions — regardless of whether notification was required.

Article 34 creates a separate, higher threshold: where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate directly to affected data subjects without undue delay. The communication must be in clear and plain language. Three exemptions exist: effective encryption rendering data unintelligible, subsequent measures eliminating the high risk, or disproportionate effort (in which case a public communication suffices).

Key Developments

The Court of Justice has repeatedly confirmed the broad scope of the breach concept. In TR v Land Hessen, the Court recited the full Article 33 framework, underscoring that the 72-hour clock starts when the controller becomes aware of the breach — not when the incident is fully investigated.

"Article 33 of that regulation provides: '1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority'"
— TR v Land Hessen ¶6

Enforcement confirms that delayed or absent notifications attract sanctions. The Polish DPA fined WARTA S.A. approximately €18,930 after the insurer failed to report a breach — an agent had emailed an insurance policy to an unauthorized addressee — until administrative proceedings were already initiated:

"Despite the letter requesting explanations, the controller did not report the data breach nor did it inform the data subjects about the incident."
— WARTA S.A. §2

The Irish DPC, in the Permanent TSB decision, tied the "without undue delay" standard to the moment of awareness and referenced EDPB Guidelines 9/2022 for interpretive guidance on what constitutes undue delay in practice.

Status of the Debate

This topic is contested in court. While the core notification architecture under Articles 33 and 34 is well established, several boundary questions remain actively litigated: what precisely triggers "awareness" for the 72-hour clock, how to calibrate the distinction between "risk" (Article 33 threshold) and "high risk" (Article 34 threshold), and whether particular technical measures — such as pseudonymisation without encryption — satisfy the Article 34(3)(a) exemption. Courts have not yet produced a definitive split, but the interpretive latitude in risk assessment means that supervisory authorities continue to diverge in enforcement intensity. Resolution will likely come through EDPB consistency opinions under Article 70(1)(g), which tasks the Board with issuing guidance on breach determination and undue delay, or through preliminary references clarifying the risk thresholds.

Practical Guidance

• Establish an internal breach detection and reporting pipeline so that "awareness" under Article 33(1) is triggered promptly — the 72-hour clock starts when the controller has a reasonable degree of certainty that a breach has occurred, not when investigation concludes.
• Implement a phased notification protocol: initial notification within 72 hours with known facts, followed by supplementary information under Article 33(4) as details emerge.
• Conduct a documented risk assessment for every breach to determine whether the Article 33 "risk" threshold is met (excusing authority notification) and whether the Article 34 "high risk" threshold triggers data-subject communication.
• Apply encryption or equivalent technical measures to personal data at rest and in transit — this is the most reliable path to the Article 34(3)(a) exemption from direct data-subject notification.
• Maintain an internal breach register per Article 33(5) documenting facts, effects, and remedial actions for every incident, regardless of whether external notification was required — supervisory authorities will request it during audits.