Breach 72h Notification

Executing GDPR 72-Hour Breach Notification

Overview

Article 33 of the GDPR requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This skill provides the complete operational workflow from breach discovery through supervisory authority notification, including deadline calculation that accounts for weekends and public holidays, mandatory notification content, and the decision framework for determining whether notification is required.

Notification Trigger — "Becoming Aware"

The 72-hour clock starts when the controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Per EDPB Guidelines 9/2022, Section 2.3:

• A processor must notify the controller "without undue delay" after becoming aware — the controller's 72-hour window then begins upon the controller's receipt of that notification.
• An initial suspicion of a breach (e.g., an anomalous log entry) does not start the clock. A brief investigation period is permitted to establish whether a breach has actually occurred.
• Once the controller's IT security team confirms data compromise, the controller is deemed "aware" regardless of whether the DPO or senior management has been informed.

Decision Tree: Is Notification Required?

A controller must notify the supervisory authority unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)).

Step 1: Classify the Breach Type

Step 2: Assess Likelihood of Risk

Evaluate each factor on a scale of 1 (low) to 4 (severe):

Step 3: Apply the Threshold

• Aggregate score 6 or below: Breach unlikely to result in risk — notification not required under Art. 33(1), but must be documented in the breach register per Art. 33(5).
• Aggregate score 7-15: Breach likely to result in risk — supervisory authority notification required within 72 hours.
• Aggregate score 16 or above: Breach likely to result in high risk — supervisory authority notification required within 72 hours AND data subject notification required under Art. 34.

Required Notification Content — Art. 33(3)

The notification to the supervisory authority must contain, at minimum:

(a) Nature of the Breach

• Description of the nature of the personal data breach.
• Categories of data subjects concerned (e.g., customers, employees, patients).
• Approximate number of data subjects concerned.
• Categories of personal data records concerned (e.g., names, email addresses, financial account numbers).
• Approximate number of personal data records concerned.

(b) DPO Contact Details

• Name of the Data Protection Officer: Dr. Elena Vasquez
• Email: dpo@stellarpayments.eu
• Direct phone: +49 30 7742 8001
• Postal address: Stellar Payments Group, Friedrichstraße 191, 10117 Berlin, Germany

(c) Likely Consequences

• Detailed description of the likely consequences of the breach, categorized by:
  • Physical harm (if applicable)
  • Material harm (financial loss, fraud risk)
  • Non-material harm (distress, discrimination, reputational damage)
  • Loss of control over personal data
  • Limitation of rights

(d) Measures Taken or Proposed

• Immediate containment measures already implemented
• Measures to mitigate adverse effects on data subjects
• Planned longer-term remediation actions
• Whether data subjects have been or will be notified under Art. 34