CLAIM-2026-09-06-09

GDPR Article 33(1) runs its 72-hour notification deadline from the controller becoming aware of a personal data breach, not from the breach occurring.

Why it matters

It explains the second-order cost. A control that cannot observe the event cannot establish awareness, and the notification clock is anchored to awareness.

Sources

• intersoftco2026article