Must I report a data breach to the authority?

Controller, Processor, SME

Controllers and processors of personal data established or offering services in the EU.

Yes, unless the breach is unlikely to result in a risk to people's rights and freedoms.

Controllers notify the supervisory authority; processors notify the controller; high-risk breaches are also communicated to the data subjects.

high (fine_cap_pct_turnover)

1. Assess risk to the individuals
2. Notify the supervisory authority
3. Inform data subjects where risk is high
4. Record every breach internally

Within 72 hours after becoming aware of the breach.

• GDPR Art. 33
• GDPR Art. 34
• GDPR Art. 83(4)

sha256 52d7b81710e09b4d329bd3ed58ed869274c3453b5925d0c36be0cc10e268440c · read 2026-10-15 · Source: NovaCopilot

• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Does my small company need a GDPR processing register?
• How fast must I answer a request for personal data?

• eu:gdpr (action_kit)
• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)