When must a personal data breach be reported, and to whom?

• EU

  Article 33: 72 hours to the supervisory authority from awareness, with reasons for any delay. Article 34: notice to the individuals without undue delay where the risk to their rights is high.

  Regulation (EU) 2016/679 · Europeiska unionens publikationsbyrå

• United States

  California requires notice to affected residents in the most expedient time possible without unreasonable delay, and notice to the attorney general above 500 affected residents.

  Cal. Civ. Code § 1798.82 · California Legislative Counsel

• Sweden

  Notification goes to the Authority for Privacy Protection through its reporting form, and the internal breach register is expected at inspection.

  IMY, anmälan av personuppgiftsincident · Integritetsskyddsmyndigheten

• Norway

  Notification goes to Datatilsynet within the same 72 hours, through the authority's reporting route.

  Datatilsynet, avviksmelding · Datatilsynet

• Germany

  Notification goes to the competent state authority, or to the federal commissioner for federal bodies and telecommunications.

  BfDI, Meldung nach Art. 33 DSGVO · Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

• Article 33(1): notification without undue delay and, where feasible, within 72 hours of becoming aware.
• Article 33(5): the controller documents every breach, including the facts, the effects and the remedial action.
• Article 34(3): no notice to the individuals where the data was encrypted or the risk has been mitigated afterwards.

Fix the moment of awareness in writing, because the clock starts there and not at the incident, and keep the internal register even for breaches you decide not to report.

A notice must describe the breach in clear language, name a contact point and state the likely consequences and the measures taken.

Read the 72 hour duty together with the 24 hour early warning under NIS2, because an entity in scope of both reports twice, on two clocks.

All global questions