In short. A website acting as controller must inform affected people without undue delay when a personal data breach is likely to create a high risk, subject to Article 34 exceptions.
Definition: Under Article 34 of the General Data Protection Regulation (GDPR), a website operator acting as controller must tell affected people about a personal data breach without undue delay when it is likely to result in a high risk to their rights and freedoms. Article 34 provides exceptions for protective measures, subsequent risk removal and disproportionate effort, with public communication required in the last case.
Key facts
- GDPR Article 34 requires clear and plain language describing the breach and specified information about contacts, consequences and response measures.
- The European Data Protection Board's (EDPB) breach notification guidelines recommend a dedicated message, separate from newsletters or regular updates.
- The EDPB's small business guide explains that breaches include accidents, such as sending an email to the wrong recipient, as well as deliberate attacks.
What triggers communication to visitors?
A controller is the person or organisation that determines the purposes and means of processing personal data. A personal data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. These definitions appear in GDPR Article 4(7) and (12).
As of 17 October 2026, Article 34(1) requires communication to affected people without undue delay when a breach is likely to create a high risk to their rights and freedoms. Article 33(1) separately requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to people.
The EDPB's guidelines explain that the threshold for informing individuals is higher than the threshold for notifying the authority. Risk assessment considers the likelihood and severity of harm; examples include identity theft, financial loss and reputational damage. The guidelines identify data sensitivity and combinations of information as relevant: identity documents and credit card details together can facilitate identity theft.
What must the notice contain, and how should it reach people?
Under Article 34(2), the notice describes the nature of the breach in clear and plain language. It also includes the information required by Article 33(3)(b) to (d): the name and contact details of the data protection officer or another contact point, likely consequences, and measures taken or proposed to address the breach, including appropriate mitigation.
The EDPB's guidelines recommend direct communication in principle, using a dedicated message. They give email and SMS as examples and recommend specific protective advice where appropriate, such as resetting passwords when access credentials are compromised. A press release or corporate blog alone is ineffective for communicating a breach to an individual. Relevant languages and accessible alternative formats may also be needed.
When does Article 34 allow an exception?
Article 34(3) sets out the following conditions:
- Appropriate technical and organisational protection measures are applied to the affected data, particularly measures making it unintelligible to unauthorised people, such as encryption.
- Subsequent measures ensure that the high risk to affected people's rights and freedoms is no longer likely to materialise.
- Contacting individuals involves disproportionate effort. Public communication or a similar measure must then inform them equally effectively.
The EDPB's small business guide illustrates the encryption exception with encrypted data whose encryption keys remain uncompromised. Under Article 34(4), the supervisory authority can require communication or decide that an exception applies.
Related terms
- When must a website owner report a personal data breach?
- How does GDPR Article 32 apply to website security?
- When does a website operator need a data protection officer?
FAQ
Do you have 72 hours to tell visitors?
Article 34(1) requires communication without undue delay. The EDPB guidelines explain that this means communicating as soon as possible; the 72-hour provision belongs to authority notification under Article 33(1).
Can you omit a breach from internal records if visitors need no notice?
Article 33(5) requires the controller to document personal data breaches, including the facts, effects and remedial action. That documentation must enable the supervisory authority to verify compliance.
Sources
- EUR-Lex, "Regulation (EU) 2016/679", 27 April 2016
- European Data Protection Board, "Guidelines 9/2022 on personal data breach notification under GDPR", adopted 28 March 2023
- European Data Protection Board, "Data breaches", undated
Check how a page reads to answer engines. Open the GEO score analyzer