.svg){kind=logo}
Every day, 443 personal data breach notifications land on the desks of European regulators, a staggering 22% spike year-on-year. The moment a breach occurs at your company, an unyielding clock starts ticking, giving you just 72 hours to act.
Unfortunately, most organizations learn about the nuances of GDPR compliance the hard way: after a regulator comes knocking. This comprehensive guide ensures you are never caught off guard.
Under GDPR, any breach of personal data that risks individual rights must be reported to your supervisory authority within the strict 72-hour window. There is no grace period and no room for delay unless you can justify the extension in writing.
Missing this deadline is a severe violation on its own, carrying potential fines of up to €10 million or 2% of your global annual turnover.
To help you navigate this high-stakes environment, this guide breaks down everything you need to know in plain language:
- What Actually Counts as a GDPR Breach?
- The Rules of Articles 33 and 34.
- A Step-by-Step 72-Hour Timeline.
- Notification Requirements.
- Real Case Studies.
- An Actionable Checklist.
Let’s explore the core concepts of a GDPR breach so you can protect both your users and your business.
Not sure if your team could hit the 72-hour window right now? ComplyJet helps SaaS companies build audit-ready GDPR compliance from day one, breach response workflows included. Start your free trial.
What Is a GDPR Breach?
Most people hear the term data breach and picture a hacker. That's one type, but under GDPR, the definition is much wider.
The regulation defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
That means any of the following count as a breach:
- An employee accidentally deletes a customer database.
- You sent a marketing email to the wrong list.
- A laptop with unencrypted customer data gets stolen.
- Ransomware locks up files that include personal information.
- An employee accesses records they have no business reason to view.
- A third-party vendor you use suffers a security incident that affects your customers' data.
The Three Types of GDPR Breaches
It is now clear what a GDPR breach is; there are three types of GDPR Breaches:
Confidentiality breach: Someone who shouldn't have accessed personal data did. This includes accidental disclosures, wrong-recipient emails, and unauthorized access by staff or outsiders.
Availability breach: Personal data was lost or destroyed. This could be ransomware, accidental deletion, or a system failure that wipes records with no backup.
Integrity breach: Personal data was altered without authorization. Think of records being tampered with, either by an external attacker or an internal bad actor.
Related Read: GDPR in Cybersecurity: Requirements, Checklist, and Compliance Framework
Not Every Breach Requires Notification
This is an important point that many teams miss. If the breach is unlikely to result in a risk to the rights and freedoms of natural persons, you don't have to notify your supervisory authority. This matters; you must still document it internally.
So if a single internal-only email gets sent to the wrong colleague by mistake and contains no sensitive data, you probably don't need to file a notification.
Quick answer: Is sharing an email address a GDPR breach?
Yes. If a personal email address is sent to the wrong recipient or shared without a lawful basis, that is a GDPR breach. Whether it requires notification depends on the risk it creates. Most single-person accidental disclosures are low-risk and only need internal documentation, but you must still assess and record them.
Pro Tip: Set up a simple internal breach log from day one; even a shared spreadsheet works. Every incident gets logged, even the minor ones. DPAs audit these registers, and a missing entry for a known incident looks far worse than having a well-documented low-risk breach on record.
Articles 33 and 34 GDPR Rules: What You Must Do After a Data Breach
Two articles of the GDPR govern breach notification. Most companies know Article 33 exists. Fewer understand Article 34, and almost nobody fully internalizes Article 33(5). All three matter.
Article 33: Notifying the Supervisory Authority (Your DPA)
Article 33 is the 72-hour rule. If a breach is likely to result in a risk to people's rights and freedoms, you must notify your supervisory authority, your national Data Protection Authority, without undue delay and, where possible, within 72 hours of becoming aware of it.
When does the clock start?
Not when you have full technical details. The clock starts when you have a reasonable degree of certainty that a breach has occurred. If your IT team tells you at 9 am on Monday that they suspect an unauthorized access event happened over the weekend, the clock starts at 9 a.m. on Monday, not when the forensic investigation concludes three days later.
What if you miss the 72 hours?
You can still notify late, but your notification must include a written explanation of why it was delayed. Regulators do accept late notifications with good reason. What they don't accept is silence.
Who actually notifies?
If you are a data controller (you decide what data is collected and why), you notify the DPA. If you are a data processor (you process data on behalf of a controller), your job is to notify the controller, not the DPA directly. And you should do that fast. The industry standard is within 24 hours, to give the controller enough runway to meet the 72-hour deadline.
Which DPA do you notify?
If your company has a main EU establishment, you notify the DPA in that country, which is your "lead supervisory authority." If you're based outside the EU but have affected EU residents, you notify the DPA in the country where those individuals were affected. For most US-based SaaS companies with EU customers, this will often be the Irish DPC, the German BfDI, or the French CNIL, depending on where your European operations sit.
Article 34 - Notifying the Affected Individuals
Article 33 is about telling the regulator. Here, Article 34 is about telling the actual people whose data was involved.
You must notify individuals directly without undue delay when a breach is likely to result in a high risk to their rights and freedoms. High risk means real, serious consequences: identity theft, financial fraud, physical harm, discrimination, or significant psychological distress.
There are three situations where you don't have to notify individuals:
- The data was encrypted or otherwise made unreadable to anyone who accessed it without authorization.
- You took action quickly enough to eliminate the high risk before it materialized.
- It would take disproportionate effort to reach individuals, in which case you must issue a public notice instead.
Note: the encryption exemption is only valid if the encryption was strong and the keys were not compromised in the same incident. Post-breach encryption doesn't count.
Related Read: 10 GDPR Compliance Strategies for 2026
Article 33(5) - The Documentation Requirement
This one gets overlooked the most. Even if a breach doesn't meet the threshold for DPA notification, Article 33(5) requires you to document it internally.
Your internal breach register must record the nature of the breach, its effects, and what you did about it. DPAs can request this register at any time during an audit or investigation. If it's incomplete or has missing entries for known incidents, that's a problem even if those incidents wouldn't have needed external notification on their own.
Pro Tip: Your lead supervisory authority matters more than you think. If you're a US company with an EU subsidiary or significant EU user base, identify your lead DPA now before an incident occurs. Filing with the wrong authority wastes precious hours of your 72-hour window.
The 72-Hour GDPR Breach Notification Timeline
Time is not on your side after a breach. Here's how a well-prepared team moves through the 72 hours.
Hour 0: Breach Detected
Someone on your team, a developer, a customer support agent, or a vendor, notices something wrong. Maybe it's an unusual login alert. Maybe a customer calls to say their account was accessed. Maybe your monitoring system flags an anomaly.
At this point, the 72-hour clock starts. Not when you confirm it. Not when legal signs off. When you become aware.
Activate your incident response team immediately. Notify your DPO if you have one. If you don't have a formal incident response plan, this is the moment you'll wish you did.
Hours 0–12: Contain and Investigate
Stop the bleeding first. Isolate the affected systems. Revoke any compromised credentials. Block the unauthorized access path.
While containment is happening, start gathering facts: What data was involved? Whose data is it? How many people are affected? Was the data encrypted? Is this a confidentiality breach, an availability breach, an integrity breach, or some combination?
Preserve all evidence. Don't delete logs, even if they contain embarrassing information. Regulators want to see that you investigated properly.
Hours 12–24: Risk Assessment
Now that you have a clearer picture, it's time to make the notification call.
Ask these two questions:
- Is there a risk to individuals' rights and freedoms?
If yes, you must notify the DPA. - Is there a HIGH risk to individuals' rights and freedoms?
If yes, you must also notify affected individuals.
If the answer to both is no, you document it internally and move on.
If you're uncertain and you often will be at this stage, lean toward notifying. Regulators view proactive notification far more favorably than missed deadlines.
Begin drafting your DPA notification now. Don't wait until you have everything.
Hours 24–48: Draft Your Notification
GDPR allows phased notification under Article 33(4). This means you can submit what you have now and follow up with more details later. You don't need a complete forensic report to file.
At a minimum, pull together:
- The type of breach and what personal data was involved
- Approximate number of individuals and records affected
- Your DPO's name and contact details
- What consequences is the breach likely to have
- What you've already done or plan to do to address it
Most EU DPAs have online notification portals. Find yours now and familiarize yourself with the form before an incident forces you to navigate it under pressure.
Hours 48–72: Submit
File the notification through your DPA's official online portal. If you're filing after the 72-hour mark, make sure your submission includes a documented explanation for the delay.
If the high-risk threshold is met, notify affected individuals in plain, clear language. Tell them what happened, what data was involved, what the likely consequences are, and what you're doing about it. Avoid legal jargon.
Update your internal breach register regardless of whether external notification was required.
Post-72 Hours: Follow Up
The notification is filed, but you're not done. Cooperate with the DPA's investigation. Provide any supplementary information they request promptly. Conduct a root cause analysis. Update your security controls. Review your vendor agreements. Consider whether a DPIA (Data Protection Impact Assessment) is now necessary for the affected processing activity.
Pro Tip: Identify your DPA's online notification portal right now and bookmark it. Every EU member state has one, and each has its own form with slightly different requirements. Running a Google search for "ICO breach notification" or "CNIL signalement violation" during a live incident costs time you don't have.
Worried your team isn't ready to hit the 72-hour window? ComplyJet helps SaaS companies build GDPR-ready incident response workflows so when a breach hits, you're not scrambling. Book a free demo.
What to Include in a GDPR Breach Notification
Under Article 33(3), your notification to the supervisory authority must cover four things at a minimum.
1. The nature of the breach: Describe the type of breach (confidentiality, availability, integrity, or a combination). Specify the categories of personal data involved: names, email addresses, health data, financial information, and location data. Give your best estimate of the number of individuals and records affected.
2. Contact details: Provide the name and full contact information of your Data Protection Officer. If you don't have a DPO, provide the contact details of whoever is leading your breach response.
3. Likely consequences: Be honest about what could happen to affected individuals. Could they be victims of identity theft? Financial fraud? Discrimination? Reputational harm? Regulators don't expect you to predict the future, but they do expect a genuine assessment.
4. Measures taken or proposed: What have you already done? What are you planning to do? This includes containment steps, patches applied, credentials revoked, monitoring put in place, and whether you plan to notify individuals.
Related Read: GDPR certification requirements
The Phased Notification Option
Article 33(4) makes clear that incomplete information is not an excuse for missing the 72-hour deadline. If you don't have all four elements ready within 72 hours, file what you have and indicate that more information will follow. Update the DPA as your investigation progresses.
Filing an incomplete notification on time is always better than filing a complete notification late.
Where to File
Each EU member state has its own notification mechanism:
- UK - Information Commissioner's Office (ICO).
- Ireland - Data Protection Commission (DPC).
- France - Commission nationale de l'Informatique et des libertés (CNIL).
- Germany - BfDI (federal) or state-level DPA, depending on your establishment.
- Netherlands - Autoriteit Persoonsgegevens.
If you handle significant volumes of EU personal data across multiple jurisdictions, look into compliance platforms that can help pre-populate these forms and manage submission timelines automatically. The time savings during a live incident are significant.
Pro Tip: Write a notification template before an incident happens. Pre-fill the static fields (company name, DPO contact, legal basis for processing), and leave placeholders for the incident-specific details. When a breach hits, you're filling in blanks, not writing from scratch under pressure.
GDPR Breach Fines: What Are the Penalties?
GDPR fines are not theoretical. Regulators have issued over €7.1 billion in total since 2018, with €1.2 billion issued in 2025 alone. Here's how the penalty structure works.
Two Fine Tiers
Tier 1: Up to €10 million or 2% of global annual turnover (whichever is higher).
This tier covers notification failures specifically:
- Failing to notify the DPA within 72 hours (Article 33)
- Failing to notify affected individuals when required (Article 34)
- Not maintaining an adequate breach register (Article 33(5))
Tier 2: Up to €20 million or 4% of global annual turnover (whichever is higher).
This tier covers more fundamental violations:
- Breaching core data protection principles (Article 5)
- Processing personal data without a lawful basis
- Violations of data subjects' rights
Here's the critical point: a breach incident can trigger fines from both tiers simultaneously. If the underlying security failure that led to the breach is also found to violate data protection principles, you could be looking at Tier 2 fines on top of the Tier 1 notification penalty.
Real Fine Examples (2025–2026)
Here are some real fines examples regarding the GDPR notification breach:
These aren't examples from the early years of GDPR when regulators were still finding their footing. These are recent, active enforcement actions. The fines are real, and they are being issued to companies of every size.
What Affects How Large a Fine Is?
Regulators don't just apply the maximum automatically. These factors influence the final amount:
- Whether the breach was intentional or the result of negligence
- The number of individuals affected
- Whether the company self-reported proactively before the DPA became aware
- The level of cooperation during the investigation
- Whether the company had prior GDPR violations
- How quickly and effectively the company took remedial action
The message is clear: companies that are prepared, self-report quickly, cooperate fully, and fix problems fast get better outcomes. Companies that stall, deflect, or fail to document anything get the maximum.
If you miss the 72-hour window, file anyway and include a detailed written explanation of why. Regulators distinguish between companies that were genuinely overwhelmed by a complex incident and companies that simply didn't have any process in place. Transparency and cooperation reduce penalties. Silence does not.
Building a GDPR compliance program from scratch? ComplyJet makes GDPR compliance manageable for SaaS teams from data mapping and processing agreements to breach response workflows. Start your free trial.
What to Do When GDPR Is Breached: 8-Step Response Guide
When a breach happens, having a clear process is what separates teams that make the 72-hour window from teams that don't. Here are the eight steps.
Step 1: Activate Your Incident Response Team Immediately
The moment anyone becomes aware of a potential breach, the incident response team goes on alert. This means your DPO, your legal counsel, your IT security lead, and your leadership, depending on the severity. Waiting for confirmation before activating the team is one of the most common mistakes companies make, and it eats directly into your 72-hour window.
Step 2: Contain the Breach
Before anything else, stop it from getting worse. Isolate affected systems. Revoke compromised credentials. Shut down unauthorized access paths. Block lateral movement within your network if the intrusion is still active.
Critically: preserve all evidence. Don't wipe logs. Don't reset systems to factory defaults until forensic copies have been made. A DPA investigation may require you to show exactly what happened and when.
Step 3: Assess and Classify
Once containment is underway, shift focus to understanding what you're dealing with. What type of breach is it? What personal data was involved, and whose? How many individuals are affected? What's the likely real-world impact?
These answers drive every subsequent decision.
Step 4: Decide on Notification Obligations
With the assessment in hand, make the call:
- DPA notification required?
Yes, if there is a risk to individuals' rights and freedoms. - Individual notification required?
Yes, if there is a HIGH risk to individuals' rights and freedoms. - No external notification required?
Document internally under Article 33(5) regardless.
When in doubt, notify. Regulators prefer over-cautious reporting to under-reporting.
Step 5: Notify Your DPA Within 72 Hours
File through your national DPA's online portal. Submit what you have. Use the phased notification provision if your investigation is still ongoing. Include your DPO's contact details, the nature of the breach, and what actions you've taken.
Step 6: Notify Affected Individuals If Required
Write to affected individuals in plain, human language, not legal boilerplate. Tell them what happened, what data was involved, what the consequences could be for them, and what you are doing to protect them. Give them a contact point for questions.
Do not delay individual notification waiting for the DPA process to conclude. Both can happen in parallel.
Step 7: Document Everything in Your Breach Register
Whether or not external notification was required, every breach goes into your internal breach register. Record the facts, the risk assessment, the decisions made, and the actions taken. This register is subject to DPA audit at any time.
Step 8: Conduct a Post-Incident Review
After the immediate crisis is resolved, do a proper root cause analysis. Where did the breach originate? What controls failed or were absent? What needs to change? Update your security controls, your vendor Data Processing Agreements, your staff training, and any relevant policies. Assess whether a DPIA is now warranted for the affected processing activity.
The companies that handle GDPR breaches best are the ones that treat every incident, even small ones, as a learning opportunity to harden their posture.
Pro Tip: Run a tabletop exercise at least once a year. Simulate a realistic breach scenario with your incident response team and walk through every step. You'll find the gaps in your process before a real breach does. This kind of preparation also demonstrates to regulators that your organization takes data protection seriously.
GDPR Breach Notification Controller vs. Processor
If you handle personal data on behalf of another company, your notification obligations are different. Here's how the two roles compare.
The Critical Risk for Processors
If you're a processor and you delay notifying your controller, you could cause the controller to miss their 72-hour window. When that happens, both parties can face enforcement action by the controller for missing the deadline, and the processor for the delay that caused it.
This is why your Data Processing Agreements matter so much. Under Article 28, your DPA should explicitly specify how quickly the processor must notify you of a breach. Twenty-four hours or less is best practice. If your current vendor contracts don't include a breach notification SLA, they need to be updated.
A Note for US Companies with EU Customers
If you're a US-based SaaS company that processes EU personal data, you are a data controller for GDPR purposes even if you've never registered anywhere in Europe. The GDPR applies based on where your users are located, not where your company is incorporated. That means the 72-hour rule applies to you.
Your lead supervisory authority is typically the DPA of the EU member state where you have the most significant EU processing activities or where your EU representative is located. If you've appointed an EU representative (required under Article 27 for non-EU companies in most cases), their country's DPA is your starting point.
Pro Tip: Audit every active vendor contract that involves personal data. If the agreement doesn't specify a breach notification timeframe, add one. A vendor that takes 5 days to tell you about a breach they experienced is a vendor that will cost you your 72-hour window and possibly €10 million.
8 Common GDPR Breach Mistakes (And How to Avoid Them)
These are the errors that regulators see repeatedly, and the ones that turn manageable incidents into expensive enforcement actions.
1. Starting the clock too late: The 72 hours begin when you become aware, not when you're certain. "We were still investigating" is not a valid reason for a late notification if you had reasonable certainty of a breach days earlier. Train your team to flag potential incidents immediately.
2. Delaying because the investigation is incomplete: Article 33(4) exists for exactly this situation. Submit what you have and update the DPA progressively. Waiting for a complete forensic report before filing will almost certainly push you past 72 hours.
3. Under-reporting the scope: Underestimating the number of individuals affected, whether deliberately or carelessly, can result in aggravated penalties when the true scope comes out later. Always err on the side of broader, more conservative reporting and correct upward as you learn more.
4. Assuming encryption solves everything: If data was encrypted but the encryption keys were also compromised in the same incident, the exemption doesn't apply. Assess each incident on its specific facts, not on assumptions.
5. Skipping the breach register for "minor" incidents: Article 33(5) applies to all breaches, including the ones that don't meet the notification threshold. DPAs audit these registers. A gap in your records for a known incident is a red flag that can expand the scope of an investigation.
6. Relying on manual processes: Manual notification workflows fail under time pressure. People are stressed, communication breaks down, and steps get skipped. Automate as much of your breach response workflow as possible, from detection alerts to notification drafting to DPA submission tracking.
7. Untrained staff: The majority of personal data breaches start with human error. If your staff doesn't recognize what a breach looks like, a wrong-recipient email, an unencrypted USB, or an unusual access request, they can't report it in time. Annual GDPR training is the minimum. Quarterly reinforcement is better.
8. No processor notification SLA in your vendor agreements: If your Data Processing Agreements don't require vendors to notify you within 24 hours of a breach, you are exposed. Review and update every active DPA.
Pro Tip: After updating your DPAs, send a brief note to each vendor reminding them of their notification obligations and your incident response contact. Many vendors have never been asked to notify anyone of anything, making the expectation explicit before an incident reduces the chance they freeze up when it matters.
GDPR Breach Notification Checklist
Use this checklist during a live breach response. Every step matters.
Immediate Actions (Hours 0–24)
- Activate the incident response team and notify your DPO
- Contain the breach, isolate systems, and revoke compromised credentials
- Preserve all evidence, including logs and affected files
- Identify data affected: categories, volume, and number of individuals impacted
Assessment (Hours 12–36)
- Conduct risk assessment: is this a risk, a high risk, or unlikely to result in risk?
- Determine notification obligations: DPA, individuals, both, or internal only
- Begin drafting the supervisory authority notification. Do not wait for a complete investigation
Notification (Hours 36–72)
- Submit DPA notification via the official online portal within 72 hours
- Include: nature of breach, DPO contact, likely consequences, and measures taken
- If submitting after 72 hours, include a written explanation for the delay
- Notify affected individuals (if high-risk threshold is met) in plain language
- Log breach in the internal breach register (Article 33(5))
Post-Breach Actions
- Cooperate fully with any DPA investigation
- Provide supplementary information as requested
- Conduct root cause analysis
- Update security controls, vendor DPAs, and staff training records
- Assess whether a DPIA is now required for the affected processing activity
Want a GDPR-ready compliance setup that covers breach response from day one? ComplyJet handles the full GDPR compliance journey from data mapping to incident response, so your team always knows exactly what to do. See how it works.
Frequently Asked Questions
How long do you have to report a GDPR breach?
Under Article 33, you must notify your supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights and freedoms. If notification is made after 72 hours, it must include a written explanation for the delay. The clock starts at awareness, not at confirmation of technical details.
What are the fines for a GDPR breach?
GDPR fines fall into two tiers. Notification failures missing the 72-hour deadline or failing to notify affected individuals fall under Tier 1, with fines up to €10 million or 2% of global annual turnover. If the underlying breach also involves core data protection violations like unlawful processing, Tier 2 applies: up to €20 million or 4% of global annual turnover, whichever is higher in each case.
Is sharing an email address a breach of GDPR?
Yes. Sending a personal email address to the wrong recipient, or sharing it without a lawful basis, is a GDPR breach. Whether it requires DPA notification depends on the risk it creates. A single accidental wrong-recipient email is typically low risk and only needs internal documentation, but it must be assessed and logged. A mass disclosure of email addresses would almost certainly require notification.
What should you do when GDPR is breached?
Immediately contain the breach, activate your incident response team, and assess the risk level. If a risk to individuals exists, notify your supervisory authority within 72 hours. If the breach poses a high risk, also notify affected individuals directly. Document everything in your internal breach register, regardless of whether external notification was made.
What is the difference between a data breach and a GDPR breach?
A data breach is any security incident involving data, which could include non-personal data like trade secrets or financial records. A GDPR breach specifically involves the personal data of EU residents and triggers the notification obligations under Articles 33 and 34 of the GDPR. Not all data breaches are GDPR breaches, but all GDPR breaches are data breaches.
Does a processor need to notify the DPA of a breach?
No, processors must notify the data controller, not the DPA. The controller handles DPA notification. Processors should notify their controller without undue delay, typically within 24 hours, to give the controller enough time to meet the 72-hour deadline. Delaying that notification puts both parties at risk.
Does GDPR apply to US companies?
Yes, if you process the personal data of EU residents regardless of where your company is located. A US SaaS company with European customers is subject to GDPR, including the 72-hour breach notification requirement. In most cases, you'll also need to appoint an EU representative under Article 27.
Can you notify a DPA before 72 hours if you don't have all the facts?
Absolutely, and in most cases, you should. Article 33(4) allows phased notification. File what you have within 72 hours and follow up with additional details as your investigation progresses. Filing early with incomplete information is always better than filing late with a complete report.
Wrapping Up
In 2026, 443 breach notifications were filed with European regulators every single day. The 72-hour rule is not a guideline; it's a hard deadline with real financial consequences, and regulators are enforcing it actively.
The good news is that the outcome of a GDPR breach is largely determined before the breach happens, not after. Companies with a documented incident response plan, trained staff, reviewed vendor agreements, and a maintained breach register consistently reach better regulatory outcomes even when significant incidents occur.
The question isn't whether your organization will face a data security incident. The question is whether you'll be ready when it does.
ComplyJet gives you everything you need to be ready for GDPR breach response workflows, automated compliance tracking, and expert support that keeps you ahead of regulators, not scrambling to catch up. Book a free demo today.
%20(1).png)
