Notification Obligation

Legal Framework

The notification obligation under the GDPR is governed primarily by Article 33 and Article 34. Article 33 imposes a duty on controllers to notify the competent supervisory authority of a personal data breach; Article 34 requires communication of the breach to affected data subjects when a higher risk threshold is met.

Under Article 33(1), the controller must notify the supervisory authority unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The 72-hour clock starts when the controller becomes "aware" of the breach—not when the breach occurs. Article 33(2) separately requires processors to notify controllers without undue delay.

"the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority"
— GDPR Art. 33(1)

Article 34(1) raises the threshold: communication to data subjects is required only when the breach is likely to result in a high risk to their rights and freedoms. The communication must describe the nature of the breach in clear and plain language and include the contact details, likely consequences, and mitigation measures referenced in Article 33(3)(b)–(d).

"the controller shall communicate the personal data breach to the data subject without undue delay"
— GDPR Art. 34(1)

The definition of "personal data breach" in Article 4(12) is broad, encompassing not only unauthorized access but also accidental destruction, loss, or alteration of personal data.

Key Developments

The CJEU confirmed the dual notification structure in TR v Land Hessen, reciting both Article 33 and Article 34 as distinct obligations with different risk thresholds. The Court's recitation underscores that authority notification (risk threshold) and data subject communication (high risk threshold) operate independently.

Enforcement illustrates the consequences of non-compliance. In the WARTA S.A. case, the Polish DPA fined a controller EUR 18,930 after it failed to notify both the authority and data subjects despite being advised how to do so:

"Despite the letter requesting explanations, the controller did not report the data breach nor did it inform the data subjects about the incident."
— WARTA S.A. (UODO)

The Irish DPC's decision in Permanent TSB clarified the practical assessment of "undue delay," emphasizing that the 72-hour period begins from the moment the controller becomes aware of the breach:

"This must be assessed by reference to when PTSB became aware of the personal data breach."
— Permanent TSB (DPC Ireland)

Article 33(4) permits phased notification where not all information is available at once. Article 34(3) provides three exemptions from the data subject communication duty: effective encryption, subsequent risk-mitigating measures, or disproportionate effort (requiring a public communication instead).

Status of the Debate

The notification obligation is actively contested in litigation. While the core structure—72-hour authority notification under Article 33 and high-risk data subject communication under Article 34—is well established, courts and supervisory authorities continue to grapple with boundary questions: when exactly a controller becomes "aware" of a breach, how to calibrate the risk assessment distinguishing "risk" from "high risk," and what constitutes sufficient justification for delayed notification. The EDPB has issued guidance through Guidelines 9/2022 and Guidelines 01/2021, but these do not bind courts. A CJEU ruling squarely addressing the "awareness" trigger and the proportionality of fines for late notification would resolve the principal open questions.

Practical Guidance

• Establish internal breach detection and escalation procedures so that awareness of a potential breach reaches the controller's decision-makers quickly; the 72-hour clock under Article 33(1) starts from awareness, not from full investigation.
• Conduct a documented risk assessment for every confirmed breach to determine whether the "risk" threshold for authority notification and the "high risk" threshold for data subject communication under Article 34(1) are met.
• Prepare notification templates covering the Article 33(3) content requirements—nature, contact point, likely consequences, and mitigation measures—to enable rapid filing within 72 hours.
• Document any delay: if the 72-hour deadline is missed, Article 33(1) requires reasons for the delay to accompany the notification.
• Verify processor contracts require processors to notify controllers without undue delay under Article 33(2), as controllers bear the authority-notification obligation even when the processor detects the breach.