{"object_type":"card","schema_version":1,"id":"card:eu:article:gdpr--art-33","core":{"id":"card:eu:article:gdpr--art-33","subject":"eu:gdpr--art-33","act":"gdpr","article":"33","rule":[{"role":"controller","duty":"Notify a personal data breach to the supervisory authority."},{"role":"processor","duty":"Notify the controller without undue delay after becoming aware of a breach."}],"authority":{"sanctioning":["Competent supervisory authority"],"supervisors":[{"name":"IMY: Sweden","url":"https://www.imy.se/"},{"name":"Datatilsynet: Norway","url":"https://www.datatilsynet.no/"},{"name":"EDPB: European Data Protection Board","url":"https://www.edpb.europa.eu/"}]},"timeline":{"in_force":"2016-05-24","applies":"2018-05-25","deadlines":[{"obligation":"obligation:eu:gdpr-art-33-controller","hours":72,"days":null,"note":"Not later than 72 hours after becoming aware, where feasible."}]},"provenance":{"source":"GDPR: Regulation (EU) 2016/679","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","eur_lex":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679","read_at":"2026-08-31"}},"core_hash":"c54deb5c44e52f5db4cecb741023621fe7ce97d798e9dad647886df3c8179886","extended":{"outcome":{"scope":"act","sample_size":39,"distribution":[{"outcome":"interpretation","count":16,"share":0.41},{"outcome":"permits","count":9,"share":0.231},{"outcome":"holding","count":5,"share":0.128},{"outcome":"precludes","count":5,"share":0.128},{"outcome":"does_not_preclude","count":4,"share":0.103}]},"action_kit":[{"obligation":"obligation:eu:gdpr-art-33-controller","provision":"gdpr art. 33","role":"controller","action":"Notify a personal data breach to the supervisory authority.","deadline":"72 hours","recipient":"Competent supervisory authority","verification":"authority_filing","verification_method":"Filing or publication can be shown with date and recipient.","evidence":["Filed report or declaration","Submission receipt or publication URL with date"],"exceptions":["exception:eu:gdpr-household","exception:eu:gdpr-breach-unlikely-risk"],"sanctions":["sanction:eu:gdpr-art-58-2","sanction:eu:gdpr-art-83-4"],"related_rules":["obligation:eu:ai-act-art-73-provider","obligation:eu:nis2-art-23-essential-entity","obligation:eu:dora-art-19-financial-entity","obligation:eu:amlr-art-69-obliged-entity","obligation:eu:csrd-art-19a-large-undertaking"],"source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"obligation":"obligation:eu:gdpr-art-33-processor","provision":"gdpr art. 33","role":"processor","action":"Notify the controller without undue delay after becoming aware of a breach.","deadline":null,"recipient":"The controller","verification":"authority_filing","verification_method":"Filing or publication can be shown with date and recipient.","evidence":["Filed report or declaration","Submission receipt or publication URL with date"],"exceptions":["exception:eu:gdpr-household","exception:eu:gdpr-breach-unlikely-risk"],"sanctions":["sanction:eu:gdpr-art-58-2","sanction:eu:gdpr-art-83-4"],"related_rules":["obligation:eu:ai-act-art-73-provider","obligation:eu:nis2-art-23-essential-entity","obligation:eu:dora-art-19-financial-entity","obligation:eu:amlr-art-69-obliged-entity","obligation:eu:csrd-art-19a-large-undertaking"],"source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"}],"timeline_dated":[],"affected_parties":[{"role":"controller"},{"role":"processor"}],"documentation_requirements":[{"kind":"report","role":"controller","provision":"gdpr 33","retention":null,"obligation":"obligation:eu:gdpr-art-33-controller"},{"kind":"report","role":"processor","provision":"gdpr 33","retention":null,"obligation":"obligation:eu:gdpr-art-33-processor"}],"risk_if_ignored":{"level":"high","sanctions":[{"id":"sanction:eu:gdpr-art-83-4","type":"administrative_fine","authority":"Competent supervisory authority","max_amount":"EUR 10 000 000","max_turnover_pct":2},{"id":"sanction:eu:gdpr-art-58-2","type":"corrective_order","authority":"Competent supervisory authority","max_amount":"not_in_register","max_turnover_pct":"not_in_register"}]},"related_rules":["card:eu:article:gdpr--art-12","card:eu:article:gdpr--art-13","card:eu:article:gdpr--art-14","card:eu:article:gdpr--art-15","card:eu:article:gdpr--art-17","card:eu:article:gdpr--art-30","card:eu:article:gdpr--art-32","card:eu:article:gdpr--art-34","card:eu:article:gdpr--art-5","card:eu:article:gdpr--art-24"],"related_cases":{"total":7,"by_jurisdiction":{"eu":1,"de":6},"readable":["eu:c-768-21"]},"precedent":{"leading":"de:olgk-2022-11-17-15-u-15921","judgments_in_register":7},"comparison_objects":[{"jurisdiction":"SE","kind":"supplementary","instrument":"Lag med kompletterande bestämmelser till EU:s dataskyddsförordning","identifier":"SFS 2018:218","url":"https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/"},{"jurisdiction":"NO","kind":"transposition","instrument":"Lov om behandling av personopplysninger (personopplysningsloven)","identifier":"LOV-2018-06-15-38","url":"https://lovdata.no/dokument/NL/lov/2018-06-15-38"},{"jurisdiction":"DK","kind":"supplementary","instrument":"Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer (databeskyttelsesloven)","identifier":"LOV nr 502 af 23/05/2018","url":"https://www.retsinformation.dk/eli/lta/2018/502"},{"jurisdiction":"FI","kind":"supplementary","instrument":"Tietosuojalaki","identifier":"1050/2018","url":"https://www.finlex.fi/fi/laki/ajantasa/2018/20181050"},{"jurisdiction":"DE","kind":"supplementary","instrument":"Bundesdatenschutzgesetz","identifier":"BDSG","url":"https://www.gesetze-im-internet.de/bdsg_2018/"},{"jurisdiction":"UK","kind":"transposition","instrument":"Data Protection Act 2018","identifier":"2018 c. 12","url":"https://www.legislation.gov.uk/ukpga/2018/12/contents"}],"change_history":[{"day":"2026-08-31","type":"rechecked","event":"Raden läst mot EUR-Lex utan ändring","hash_after":"50b74d20352ced07"},{"day":"2018-05-25","type":"changed","event":"Rättsakten började tillämpas","hash_after":"50b74d20352ced07"},{"day":"2016-05-24","type":"added","event":"Rättsakten trädde i kraft enligt CELEX 32016R0679","hash_after":"50b74d20352ced07"}]},"links":[{"id":"obligation:eu:gdpr-art-33-controller","type":"obligation","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller"},{"id":"obligation:eu:gdpr-art-33-processor","type":"obligation","url":"https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor"},{"id":"sanction:eu:gdpr-art-58-2","type":"sanction","url":"https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2"},{"id":"sanction:eu:gdpr-art-83-4","type":"sanction","url":"https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4"},{"id":"authority:eu:competent-supervisory-authority","type":"authority","url":"https://legal.exploreworldai.com/api/public/v1/obj/authority/eu:competent-supervisory-authority"},{"id":"action_kit:eu:gdpr--art-33","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33"},{"id":"eu:c-768-21","type":"judgment","url":"https://legal.exploreworldai.com/eu/praxis/c-768-21"},{"id":"card:eu:article:ai-act--art-73","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-73"},{"id":"card:eu:article:amlr--art-69","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:amlr--art-69"},{"id":"card:eu:article:csrd--art-19a","type":"card","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:csrd--art-19a"}],"link_count":{"total":44,"public":10,"meets_target":true},"next_questions":{"items":[{"question":"What does Article 73 AI-ACT require?","card":"card:eu:article:ai-act--art-73","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-73&view=compact"},{"question":"What does Article 69 AMLR require?","card":"card:eu:article:amlr--art-69","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:amlr--art-69&view=compact"},{"question":"What does Article 19a CSRD require?","card":"card:eu:article:csrd--art-19a","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:csrd--art-19a&view=compact"},{"question":"What does Article 19 DORA require?","card":"card:eu:article:dora--art-19","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:dora--art-19&view=compact"},{"question":"What does Article 12 GDPR require?","card":"card:eu:article:gdpr--art-12","type":"article","url":"https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:gdpr--art-12&view=compact"}],"count":5,"meets_target":true},"method":"Composed with fixed rules from the obligation, sanction, action kit, timeline, documentation, outcome, judgment reference, national implementation and change journal registers. Missing fields are not_in_register.","attribution":"Source: NovaCopilot","withheld":{"links_full":44},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T07:50:59.790Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/card?id=card%3Aeu%3Aarticle%3Agdpr--art-33","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":3179}}