Art. 33 GDPR · Chapter IV: Controller and processor · Section 2: Security of personal data
Article 33 GDPR: Notification of a personal data breach to the supervisory authority
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The controller must notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A processor must notify the controller without undue delay, and the controller must document every breach.
Official text
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
The notification referred to in paragraph 1 shall at least:
describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
describe the likely consequences of the personal data breach;
describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
EDPB guidance
- Guidelines 9/2022 on personal data breach notification under GDPR
EDPB 09/2022FinalFirst published 18 October 2022Final version 4 April 2023
Targeted update of WP29 WP250 rev.01, which it supersedes.
- Guidelines 01/2021 on examples regarding personal data breach notification
EDPB 01/2021FinalFirst published 19 January 2021Final version 3 January 2022
Final date is the EDPB publication date of version 2.0.
Fines
Amounts are shown in the currency in which the fine was imposed.
- Meta Platforms Ireland Limited: EUR 251,000,000
Data Protection Commission (Ireland), IrelandDecision of 12 December 2024Appeal status: under appeal
A 2018 'View As' token flaw exposed about 29 million Facebook accounts (about 3 million in the EU/EEA); incomplete breach notification and poor design and default safeguards.
- Meta Platforms Ireland Limited: EUR 91,000,000
Data Protection Commission (Ireland), IrelandDecision of 26 September 2024Appeal status: under appeal
Stored some Facebook users' passwords in plain text, notified the breach late and did not document it.
- Booking.com B.V.: EUR 475,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 10 December 2020Appeal status: not appealed
Reported a data breach (hotel-staff phishing in the UAE, 4,109 people affected) 22 days late.
- Twitter International Company: USD 500,000
Data Protection Commission (Ireland), IrelandDecision of 9 December 2020Appeal status: unknown
Notified a personal data breach late and did not document it properly (a bug that exposed protected tweets).
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.