CLAIM-2026-09-28-11
GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible not later than 72 hours after the controller becomes aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; Article 33(2) requires the processor to notify the controller without undue delay after becoming aware.
Why it matters
The 72 hours run from the controller's awareness, and the processor's own clock is separate and earlier.
Sources
- intersoftco2026article