CLAIM-2026-09-18-08

Article 33(1) GDPR requires notification to the supervisory authority without undue delay and where feasible not later than 72 hours after the controller becomes aware of the breach, and Article 33(3)(a) requires the notification to describe the nature of the breach including the categories and approximate number of personal data records concerned.

Why it matters

It is the clock and the content requirement in one place. Seventy-two hours to describe categories and approximate numbers of records is only achievable if writes were logged with prior values.

Sources

• eurlex2016regulatio