GDPR / RULE REFERENCE

Art. 33 — 72-hour breach notification

The 72-hour clock starts at "awareness" — read in guidance as the moment you had reasonable certainty a breach occurred, not when forensics conclude. Most organisations that miss the deadline did not lack tooling; they lacked an incident record that existed before the incident, so day one went to reconstructing events instead of reporting them.

The rule

A personal-data breach must be reported to the supervisory authority within 72 hours of becoming aware — "where feasible". The clock is unforgiving if you discover late.

What it means for how you build

You need an incident record that exists before the incident: severity, detection time, containment, and a computed notification deadline — not a wiki page written during the panic.

Self-check

Does detection timestamp the moment of awareness — not the moment forensics finished?
Is the notification deadline computed automatically at incident creation?
Can you answer "what data, how many subjects, which systems" in hours, not days?
Is there a documented severity line between reportable and record-only incidents?

Common pitfalls

Treating "forensics complete" as the deadline start — awareness is earlier, and the clock is unforgiving.
No incident ledger: reconstructing the timeline from chat threads under regulator scrutiny.
Reporting every anomaly "to be safe" — over-reporting trains regulators to see noise, and still leaves you with records to maintain.

How the engine checks it

Incident ledger with Art. 33 deadlines computed at creation — the record exists when the regulator asks for it.

Sources

Related rules

Last reviewed 2026-11-01.