CLAIM-2026-08-02-05

Article 33(1) GDPR requires the controller, without undue delay and where feasible not later than 72 hours after having become aware of it, to notify a personal data breach to the supervisory authority. Article 33(2) requires a processor to notify the controller without undue delay after becoming aware.

Why it matters

The 72-hour clock runs from awareness, not from the breach. If awareness arrives by vendor email about events months earlier, the controller still owes the notification and still needs the facts to fill it in.

Sources

• intersoftco2026article