Article 33 of the GDPR: Notification of personal data breaches
·
Updated on ·
By 
Bertrand Bucelle · 2 min read
Article 33 of the GDPR Explained
In the event of a breach (e.g., unauthorised access, loss, accidental disclosure, etc.), the data controller must:
- Inform the French supervisory authority (or other competent authority) within 72 hours of becoming aware of it;
- Explain the nature of the breach, the data concerned, the possible consequences, and the measures taken or envisaged;
- Maintain a record of all breaches, whether notified or not.
The data processor, if concerned, must notify without delay the data controller.
Why is this article important for your GDPR compliance?
Data breaches can have serious consequences for the data subjects concerned: identity theft, privacy violations, fraud… Article 33 ensures transparency and responsiveness of organisations in the face of these incidents, and contributes to strengthening user trust.
Article 33 GDPR Application Examples
- An email sending error containing sensitive data to the wrong recipient: the French supervisory authority is informed within 72 hours;
- A laptop theft containing unencrypted data triggers an incident notification procedure;
- A security vulnerability is detected on a client server: the sub-processor immediately alerts its principal.
Related Resources
Accelerate Your Compliance in a Few Clicks
With our all-in-one solution, you can easily accelerate and ensure your compliance:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Train your teams with our GDPR e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.
How to comply with GDPR Article 33?