In short. A website owner acting as controller must report a personal data breach without undue delay and, where feasible, within 72 hours of awareness unless risk to people’s rights and freedoms is unlikely.
Definition: Under Article 33 of the General Data Protection Regulation (GDPR), a website owner determining the purposes and means of processing personal data is a controller and must notify the competent data protection authority of a personal data breach unless it is unlikely to result in a risk to people's rights and freedoms. Notification is due without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
Key facts
- The GDPR's Article 33(1) requires reasons for delay when notification takes longer than 72 hours.
- The European Data Protection Board (EDPB), in its breach notification guidelines, treats awareness as a reasonable degree of certainty that a security incident has compromised personal data.
- France's data protection authority, CNIL, explains in its notification guidance that an initial notification can be followed by a supplementary notification when further information becomes available.
Which breaches trigger the duty?
The GDPR's Article 4(7) defines a controller as the person or organisation determining the purposes and means of processing personal data. A website owner with that role carries the Article 33 notification duty. A processor handles personal data on the controller's behalf; under Article 33(2), it must notify the controller without undue delay after becoming aware of a breach.
Article 4(12) defines a personal data breach as a security breach involving accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. The definition therefore covers lost or altered data as well as disclosure.
As of October 2026, the EDPB's Guidelines 9/2022, version 2.0 recommend assessing both the likelihood and severity of consequences for individuals. Relevant factors include the type of breach and the nature, sensitivity and volume of the affected data. The guidelines identify compromised identity documents and financial data as possible sources of harm, including identity theft when data is combined.
When does the notification period start?
The EDPB's guidelines, paragraphs 31 to 35, allow a short initial investigation to establish whether a suspected incident involves a personal data breach. That investigation should begin as soon as possible. Once the controller has reasonable certainty, the notification period begins; a more detailed investigation can follow.
Under the GDPR's Article 33(4), information that cannot be supplied together may be provided in phases without undue further delay. Article 33(1) still requires notification without undue delay and, where feasible, within 72 hours, with reasons supplied for a later notification.
What must the report and internal record contain?
The GDPR's Article 33(3) requires the notification to describe the breach's nature, including, where possible, the categories and approximate numbers of affected people and personal data records. It must also give the data protection officer's or another contact point's name and contact details, describe likely consequences, and explain measures taken or proposed to address the breach and mitigate adverse effects.
Article 33(5) requires documentation of every personal data breach, covering the facts, effects and remedial action. The documentation must allow the authority to verify compliance. The EDPB's guidelines, paragraph 125, also recommend recording the reasoning behind decisions, including why an unreported breach is considered unlikely to create a risk.
Related terms
- How does GDPR Article 32 apply to website security?
- When must a website tell affected visitors about a data breach?
FAQ
Can you wait until every affected record is counted?
The GDPR's Article 33(3) and (4) allow approximate numbers where possible and information in phases. You must supply subsequent information without undue further delay.
Must you record a breach that requires no authority notification?
Yes. Article 33(5), described above, requires documentation of any personal data breach. The EDPB guidance also recommends keeping the justification for deciding against notification.
Does reporting to the authority also cover telling visitors?
Article 34 sets a separate duty to communicate a breach to affected people without undue delay when it is likely to result in a high risk to their rights and freedoms, subject to that article's exceptions.
Sources
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
- European Data Protection Board, "Guidelines 9/2022 on personal data breach notification under GDPR", version 2.0, 28 March 2023
- CNIL, "Notifier une violation de données personnelles", 24 May 2018
Check how a page reads to answer engines. Open the GEO score analyzer