{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-33-controller","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-33-controller)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-11-02","fingerprint":"ewai:eu:ba7f8d","proof":"sha256:aa67da38f1b562c6feb2ee3e644346a07a348d2b8e650b97148e88384e8c0713","jurisdiction":"eu","lang":"en"},"brand_source":"Source: NovaCopilot","status":"ok","id":"duty:eu:gdpr-art-33-controller","schema_version":1,"domain":"gdpr","jurisdiction":"eu","act":"gdpr","provision":"33","obligation":"Notify a personal data breach to the supervisory authority.","responsible_role":{"legal_role":"controller","owner_function":"Legal and compliance"},"deadline":{"value":"72 hours","note":"Not later than 72 hours after becoming aware, where feasible.","recipient":"Competent supervisory authority","applies_from":"2018-05-25"},"exceptions":[{"provision":"GDPR art. 2.2 c","condition":"Processing by a natural person in the course of a purely personal or household activity.","effect":"not_applicable","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"},{"provision":"GDPR art. 33.1","condition":"The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.","effect":"not_applicable","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"}],"risk":{"level":"high","basis":"Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low","max_amount":"EUR 10 000 000","max_turnover_pct":2,"sanctions":[{"id":"sanction:eu:gdpr-art-83-4","authority":"Competent supervisory authority"},{"id":"sanction:eu:gdpr-art-58-2","authority":"Competent supervisory authority"}]},"evidence_chain":[{"step":1,"kind":"primary_source","ref":"GDPR: Regulation (EU) 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},{"step":2,"kind":"provision","ref":"gdpr 33"},{"step":3,"kind":"obligation","ref":"obligation:eu:gdpr-art-33-controller","method":"Paraphrased from the provision text"},{"step":4,"kind":"evidence_to_keep","ref":"Copy of notification with timestamp"}],"source":{"title":"GDPR: Regulation (EU) 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},"recommended_action":{"do":["Assess whether the breach is likely to result in a risk to individuals; if not, notification is not required but the breach must still be documented.","Notify the supervisory authority with the information in Art. 33(3); information may be provided in phases.","Give reasons if notification is made after 72 hours.","Document all breaches, effects and remedial action (Art. 33(5)) and notify data subjects without undue delay where the risk is high (Art. 34)."],"status":"reviewed_action_kit"},"hash":"sha256:aa67da38f1b562c6feb2ee3e644346a07a348d2b8e650b97148e88384e8c0713","what_to_do":{"timing":{"kind":"deadline","text":"72 hours"},"steps":["Assess whether the breach is likely to result in a risk to individuals; if not, notification is not required but the breach must still be documented.","Notify the supervisory authority with the information in Art. 33(3); information may be provided in phases.","Give reasons if notification is made after 72 hours.","Document all breaches, effects and remedial action (Art. 33(5)) and notify data subjects without undue delay where the risk is high (Art. 34)."],"steps_status":"reviewed_action_kit","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj"},"gaps":[],"links":{"obligation_graph":"https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr","provenance_graph":"https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr","action_graph":"https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr","self":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-33-controller"},"read_at":"2026-08-31","source_label":"Source: NovaCopilot","version":"legal-2026-11-02","expires":"2026-11-06T00:00:00.000Z","dependency":{"index_version":"legal-2026-11-02+legal-2026-11-02+2026-11-02T16:22:18","content_hash":"sha256:aa67da38f1b562c6feb2ee3e644346a07a348d2b8e650b97148e88384e8c0713","revalidate_after":"2026-11-03T02:29:48.671Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-33-controller","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","freshness":{"freshness_class":"live","as_of":"2026-11-03T01:29:49.067Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-33-controller","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1612}}