CLAIM-2026-10-02-09

GDPR Article 33(1) requires a controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Why it matters

This is the limb that actually reaches an agent that published customer billing records. It has no deferral and its clock starts at awareness.

Sources

• gdprinfoeu2026article