Set by the law · GDPR Art. 33(1)
Notification of a personal data breach
In plain English
A controller must report a personal data breach to the data protection authority within 72 hours where feasible, unless it is unlikely to create a risk, and must tell the people affected if the risk is high.
The official text
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
171 decisions on Fino cite Article 33 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.