When must a data breach be reported under GDPR?
The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights. If the risk is high, the individuals affected must also be informed. All breaches must be documented.
Answer from NovaCopilot, legal.exploreworldai.com/en/fragor/fragat/eu-gdpr-personuppgiftsincident, checked 2026-10-01.
- Source
- Artikel 33 och 34, förordning (EU) 2016/679, EUR-Lex. Read
- Provision
- GDPR articles 33(1), 33(5) and 34(1)
- Object
- question:eu:eu-gdpr-personuppgiftsincident
- Source
- NovaCopilot
General information based on the legislation, not advice on an individual case.