Art. 33 GDPR – Notification of a personal data breach to the supervisory authority
| Art. 33(1) | In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. | 72-hour notification |
| Art. 33(2) | The processor shall notify the controller without undue delay after becoming aware of a personal data breach. | processor to controller |
| Art. 33(3) | The notification referred to in paragraph 1 shall at least:
| minimum content |
| Art. 33(4) | Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. | notification in phases |
| Art. 33(5) | The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. | internal breach record |
When personal data are breached, the controller has to tell its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If the investigation isn’t finished, the information can follow in phases. Every breach, notified or not, goes into an internal record that the authority can use to check compliance.
Regulators have enforced each part of the Article separately. The Dutch authority fined Booking.com €475.000 for notifying 22 days late, and the Irish DPC fined Twitter €450.000 for a late notification and an inadequate breach record. Against Meta, the DPC imposed €11.000.000 for an incomplete notification and missing record, and €16.000.000 for a breach it never notified in time.
Key Facts
| Chapter | Chapter IV – Controller and processor, Section 2: Security of personal data (Art. 32–34) |
|---|---|
| Applies to | Controllers, which notify the supervisory authority; processors, which notify the controller (Art. 33(2)) |
| Deadline | Without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. A later notification must give reasons for the delay |
| Maximum fine | Up to €10.000.000 or 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)(a)) |
| In force since | 25 May 2018 |
| Explained by recitals | Recitals 85, 87 and 88 |
| Depends on | Art. 4(12) (definition of personal data breach), Art. 55 and Art. 56 (which authority to notify) and Art. 32 (security of processing) |
| Works with | Art. 34: where the breach is likely to result in a high risk, the data subjects must also be told |
| Official guidance | EDPB Guidelines 9/2022 on personal data breach notification, version 2.0, adopted 28 March 2023 |
| Pending change | The Commission’s Digital Omnibus proposal (COM(2025) 837, 19 Nov 2025) would raise the threshold to “high risk”, extend the deadline to 96 hours and add a single entry point for notifications. It is not law: the European Parliament is still handling it in committee |
| EU institutions | Not covered. EU institutions and bodies notify the European Data Protection Supervisor under Regulation (EU) 2018/1725, which replaces the GDPR for them (Art. 2(3)) |
| Closest UK equivalent | UK GDPR, Article 33 (retained with the same 72-hour deadline) |
What Article 33 Requires
Article 33 sets out five obligations. Supervisory authorities and the EDPB have clarified how each one works in practice:
| Question | Answer | Source |
|---|---|---|
| Does every breach have to be notified? | No. Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where data end up with an unauthorised person, the Dutch authority held that a risk already exists | Art. 33(1); AP, Booking.com |
| Can I wait until the investigation is complete? | No. An investigation can take longer than 72 hours, which is why Art. 33(4) allows the information to follow in phases. The initial notification still has to meet the deadline | Art. 33(4); AP, Booking.com |
| What does a late notification need? | Reasons for the delay | Art. 33(1) |
| What must the notification contain? | At least the four elements in Art. 33(3). Leaving out information the controller could and should have included is a separate infringement | Art. 33(3); DPC, Meta (token breach) |
| Which breaches must be documented? | Any personal data breach, including those not notified. The record must cover the facts, effects and remedial action, and let the authority verify compliance | Art. 33(5) |
| Is incident-management paperwork enough as a record? | Not by itself. The DPC held that general reports and internal communications weren’t a record of a personal data breach, and that the record must also explain any delay and the risk assessment | Art. 33(5); DPC, Twitter |
| Where does a non-EU controller notify? | Having an EU representative under Art. 27 doesn’t trigger the one-stop-shop, so the breach must be notified to every authority in whose Member State affected data subjects live | EDPB Guidelines 9/2022, para. 73 |
When the 72-Hour Clock Starts
The deadline runs from the moment the controller becomes “aware” of the breach. Under the EDPB guidelines, that is when the controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Authorities have been strict about how early that point arrives:
| Situation | What the authority decided | Source |
|---|---|---|
| Warnings reached front-line staff but weren’t escalated | Booking.com was aware on 13 January 2019, when a hotel reported a second, similar fraud attempt, not on 4 February when its security team finished investigating. Staff breaching the company’s own escalation policy was attributed to the company | AP, 10 Dec 2020 |
| The processor knew but the controller’s DPO didn’t | Twitter International ought to have been aware by 3 January 2019, when its processor assessed a potential breach, even though it was actually told on 7 January. The controller’s duty can’t depend on the processor’s compliance with Art. 33(2) | DPC, 9 Dec 2020 |
| The delay fell over a holiday period | Not accepted. Risks to data subjects can’t be put on hold because of a weekend or public holiday, especially when the service itself keeps running | DPC, 9 Dec 2020 |
| Internal data were found stored insecurely | Plaintext password logs were each a personal data breach under Art. 4(12), even without external access; notification was due within 72 hours of their discovery on 31 January 2019 | DPC, 26 Sep 2024 (case covered on our Meta Article 5 page) |
Fines issued under Article 33
Each decision below turned on a different part of Article 33: timing, content or documentation. Selected decisions:
| Organisation | Authority | Date | Fine | Provision breached |
|---|---|---|---|---|
| Meta Platforms Ireland (“View As” token breach) | DPC (Ireland) | Dec 2024 | €11.000.000 | Art. 33(3) and 33(5) – notification left out required information; no contemporaneous record. Total fines €251.000.000, including Art. 25 |
| Meta Platforms Ireland (plaintext passwords) | DPC (Ireland) | Sep 2024 | €16.000.000 | Art. 33(1) and 33(5) – breach not notified within 72 hours and not documented. Total fines €91.000.000, including Art. 5(1)(f) and 32(1) |
| Booking.com | AP (Netherlands) | Dec 2020 | €475.000 | Art. 33(1) – breach notified 22 days late |
| Twitter International | DPC (Ireland) | Dec 2020 | €450.000 | Art. 33(1) and 33(5) – late notification after a processor delay; inadequate breach record |
All Article 33 enforcement cases
Recitals That Explain Article 33
Recital 85 – Notification obligation of breaches to the supervisory authorityA breach not addressed in time can cause physical, material or non-material damage, such as loss of control over data, identity theft or fraud. The controller should notify without undue delay and, where feasible, within 72 hours, unless it can show, in line with the accountability principle, that the breach is unlikely to result in a risk. Late notifications give reasons, and information may follow in phases.
Recital 87 – Promptness of reporting / notificationThe controller should check that it has the technical and organisational measures in place to establish immediately whether a breach has happened. Whether a notification was made without undue delay depends on the nature and gravity of the breach and its consequences, and the notification may lead the authority to intervene.
Recital 88 – Format and procedures of the notificationRules on the format and procedure should take into account the circumstances of the breach, including whether the data were protected by technical measures that limit the likelihood of identity fraud, and the legitimate interests of law-enforcement authorities where early disclosure could hamper an investigation.
Checklist: Controllers and Processors
- Controller: route every suspected incident to the team that assesses breaches straight away, including reports from partners and customers (Booking.com)
- Controller: make sure the DPO or privacy lead is automatically part of the incident workflow, and staff the process over weekends and holidays (Twitter)
- Controller: notify within 72 hours with what you know, and send the rest in phases under Art. 33(4) rather than waiting for the full investigation (Booking.com)
- Controller: fill in every Art. 33(3) element you can already answer, including the categories of data subjects and records and the likely consequences (Meta token breach)
- Controller: keep a dedicated, contemporaneous record for every breach, notified or not, including the reasons for any delay and how you assessed the risk (Twitter, Meta passwords)
- Processor: tell the controller without undue delay; your delay can still count against the controller (Art. 33(2); Twitter)
- Non-EU controller: plan to notify each authority where affected data subjects live (EDPB Guidelines 9/2022, para. 73)
- Everyone: keep working to the 72-hour rule; the 96-hour Digital Omnibus proposal isn’t law
Each of these cases came down to evidence: when the organisation knew, what it reported and what it wrote down. A breach register that sits next to your records of processing makes that evidence ready before the authority asks for it.