European UnionGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(4)(a) subjects the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43, which include the Article 33 and 34 breach notification duties, to the lower administrative-fine tier, up to EUR 10,000,000 or 2 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of Articles 33 and 34 alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
- As of
- Guidance link
- https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf
- Guidance body
- European Data Protection Board
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller must document any personal data breach, whether or not it is notified, recording the facts relating to the breach, its effects and the remedial action taken, and the documentation must enable the supervisory authority to verify compliance with Article 33. The three items the clause lists do not match any entry in the closed list of log contents, so none is recorded.
- Kind
- Explicit
- As of
- Provision
- Article 33(5)
- Trigger
- security_incident
Why the legislator wanted it
The European Data Protection Board links the breach documentation to the accountability principle and says the supervisory authority can request to see the records.
- As of
- Quote
- linked to the accountability principle of the GDPR, contained in Article 5(2) GDPR. The purpose of recording non-notifiable breaches, as well notifiable breaches, also relates to the controller’s obligations under Article 24 GDPR, and the supervisory authority can request to see these records.
- Source link
- https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf
- Source kind
- Regulator guidance
- Purpose
- accountability_demonstration
- regulator_supervision
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Article 33(1) requires the controller to notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk individuals' rights and freedoms, and a processor must notify its controller without undue delay.
Article 34 requires notice to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless the exposed data was rendered unintelligible, for example by strong encryption, or the controller has since eliminated the high risk.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .