CLAIM-2026-09-12-08

GDPR Article 33 requires notification of a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

Why it matters

It is the comparator every engineer already has in muscle memory. The CRA's early warning is a third of that window and goes to a different authority, which is why the two clocks cannot share one runbook entry.

Sources

• intersoftco2026article