Amendment 1672· EUDPR Article 34(1)
~Alternative
Text of the amendment
As tabled
Wordingagainst the Commission’s
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay. Controllers shall continue to document non-notified personal data breaches.
Struck CommissionHighlighted amendment
EUDPR Article 34 with this amendment
Amendment 1672 applied to the Commission proposal, no other amendment
In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay. Controllers shall continue to document non-notified personal data breaches.
~AmendedUnchanged: (2), (3), (4), (5) and (6)
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
The notification referred to in paragraph 1 shall at least:
describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
communicate the name and contact details of the data protection officer;
describe the likely consequences of the personal data breach;
describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
The controller shall inform the data protection officer about the personal data breach.
The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the European Data Protection Supervisor to verify compliance with this Article.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
Law in forceEUDPR, Article 34(1)
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the European Data Protection Supervisor is not made within 72 hours, it shall be accompanied by reasons for the delay.
Commission proposalCOM(2025) 837
1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.
Council text of 22 October 2026ST 14756/26
1.In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.
Cite this amendment
Amendment 1672 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1565–1740 to the draft report on COM(2025) 837 (CJ72-AM-791874, PE791.874v01-00, 27 July 2026), p. 103
Link, short form and official text
Amendment 1672 (Julie Rechagneux and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1565–1740 to the draft report on COM(2025) 837 (CJ72-AM-791874, PE791.874v01-00, 27 July 2026), p. 103
ITRE–LIBE Amendment 1672 (CJ72-AM-791874), p. 103