Data breach notification
Under the GDPR, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours (Art. 33(1)), and notify affected people when the risk is high (Art. 34); a processor must notify the controller without undue delay (Art. 33(2)).
A controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people’s rights and freedoms (Article 33(1)). Article 34 requires informing the people affected without undue delay only when the breach is likely to result in a high risk.
A processor must notify the controller without undue delay after becoming aware of a breach (Article 33(2)). Data processing agreements often add a specific hour count for that notice, such as 48 or 72 hours, and a change to it is worth catching.
Source: GDPR Arts. 33–34 ↗
Related terms
ClauseTrail watches vendors' subprocessor lists, DPAs, privacy policies, terms and AI terms, and tells your team what changed and by when to object.