--- title: "Art. 34 GDPR: Communication of a personal data breach to the data subject" canonical: "https://dposchool.com/gdpr/article/34" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_34" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 34 GDPR · Chapter IV: Controller and processor · Section 2: Security of personal data # Article 34 GDPR: Communication of a personal data breach to the data subject Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) When a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate it to the data subject without undue delay, in clear and plain language. Paragraph 3 lists the cases in which this communication is not required. ## Official text ### Article 34(1) **1.** When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. ### Article 34(2) **2.** The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). ### Article 34(3) **3.** The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: #### Article 34(3)(a) **(a)** the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; #### Article 34(3)(b) **(b)** the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise; #### Article 34(3)(c) **(c)** it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. ### Article 34(4) **4.** If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 34 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_34) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 86](https://dposchool.com/gdpr/recital/86) ## EDPB guidance ### [Guidelines 9/2022 on personal data breach notification under GDPR](https://dposchool.com/gdpr/guidance/edpb-09-2022) EDPB 09/2022 · Final · First published 18 October 2022 · Final version 4 April 2023 Targeted update of WP29 WP250 rev.01, which it supersedes. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en) ### [Guidelines 01/2021 on examples regarding personal data breach notification](https://dposchool.com/gdpr/guidance/edpb-01-2021) EDPB 01/2021 · Final · First published 19 January 2021 · Final version 3 January 2022 Final date is the EDPB publication date of version 2.0. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [FREE MOBILE: EUR 27,000,000](https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 8 January 2026 · Appeal status: unknown After an October 2024 intrusion exposed 24 million subscriber contracts (including IBANs): weak VPN authentication and poor detection, an incomplete breach notice to subscribers, and excessive retention of former subscribers' data. [Source: the authority](https://www.cnil.fr/en/sanction-free-2026) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 34 Previous: [Art. 33 GDPR: Notification of a personal data breach to the supervisory authority](https://dposchool.com/gdpr/article/33) Next: [Art. 35 GDPR: Data protection impact assessment](https://dposchool.com/gdpr/article/35) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents