--- title: "Art. 33 GDPR: Notification of a personal data breach to the supervisory authority" canonical: "https://dposchool.com/gdpr/article/33" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_33" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 33 GDPR · Chapter IV: Controller and processor · Section 2: Security of personal data # Article 33 GDPR: Notification of a personal data breach to the supervisory authority Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The controller must notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A processor must notify the controller without undue delay, and the controller must document every breach. ## Official text ### Article 33(1) **1.** In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. ### Article 33(2) **2.** The processor shall notify the controller without undue delay after becoming aware of a personal data breach. ### Article 33(3) **3.** The notification referred to in paragraph 1 shall at least: #### Article 33(3)(a) **(a)** describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; #### Article 33(3)(b) **(b)** communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; #### Article 33(3)(c) **(c)** describe the likely consequences of the personal data breach; #### Article 33(3)(d) **(d)** describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. ### Article 33(4) **4.** Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. ### Article 33(5) **5.** The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 33 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_33) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 84](https://dposchool.com/gdpr/recital/84) - [Recital 85](https://dposchool.com/gdpr/recital/85) ## EDPB guidance ### [Guidelines 9/2022 on personal data breach notification under GDPR](https://dposchool.com/gdpr/guidance/edpb-09-2022) EDPB 09/2022 · Final · First published 18 October 2022 · Final version 4 April 2023 Targeted update of WP29 WP250 rev.01, which it supersedes. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en) ### [Guidelines 01/2021 on examples regarding personal data breach notification](https://dposchool.com/gdpr/guidance/edpb-01-2021) EDPB 01/2021 · Final · First published 19 January 2021 · Final version 3 January 2022 Final date is the EDPB publication date of version 2.0. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Meta Platforms Ireland Limited: EUR 251,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-12) Data Protection Commission (Ireland), Ireland · Decision of 12 December 2024 · Appeal status: under appeal A 2018 'View As' token flaw exposed about 29 million Facebook accounts (about 3 million in the EU/EEA); incomplete breach notification and poor design and default safeguards. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiries-meta-platforms-ireland-limited-token-breach) ### [Meta Platforms Ireland Limited: EUR 91,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-09) Data Protection Commission (Ireland), Ireland · Decision of 26 September 2024 · Appeal status: under appeal Stored some Facebook users' passwords in plain text, notified the breach late and did not document it. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-meta-platforms-ireland-limited-september-2024) ### [Booking.com B.V.: EUR 475,000](https://dposchool.com/gdpr/fine/ap-booking-2020-12) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 10 December 2020 · Appeal status: not appealed Reported a data breach (hotel-staff phishing in the UAE, 4,109 people affected) 22 days late. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/current/bookingcom-fined-for-delay-in-reporting-data-breach) ### [Twitter International Company: USD 500,000](https://dposchool.com/gdpr/fine/dpc-twitter-2020-12) Data Protection Commission (Ireland), Ireland · Decision of 9 December 2020 · Appeal status: unknown Notified a personal data breach late and did not document it properly (a bug that exposed protected tweets). [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-twitter-international-company-tic) ### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings. Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 33 Previous: [Art. 32 GDPR: Security of processing](https://dposchool.com/gdpr/article/32) Next: [Art. 34 GDPR: Communication of a personal data breach to the data subject](https://dposchool.com/gdpr/article/34) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents