EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

EUDPR· Article 34

Text

Article 34 EUDPR as printed in the Council text of 22 October 2026

Notification of a personal data breach to the European Data Protection Supervisor

Source Council, 22 October 2026. Article 34: ST 14756/26, page 153 · exact text page

Scope This text prints Article 34(1) only.

1.

In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.

Article 34 in the whole EUDPR

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal10 Jun text18 Jun text3 Sep text2 Oct text
1Paragraph 1 Amends Changed Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged Amends Unchanged 6

Each text against the law in force: ~Amends amends the law in force changed from the text before

Each text against the text before it: ~Changed wording changed=Unchanged same as the text before

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 Amends Amends paragraph 1. Article 34 in this text
  2. 10 Jun 2026 Council textST 10426/26 Unchanged Same as the text before. Article 34 in this text
  3. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 34 in this text
  4. 16 Jul 2026 IMCO amendments 329–532 to the draft opinionIMCO-AM-791061 1 amendment to this article. Amendments in this document
  5. 27 Jul 2026 ITRE–LIBE amendments 1565–1740 to the draft reportCJ72-AM-791874 5 amendments to this article. Amendments in this document
  6. 3 Sep 2026 Council textST 12535/26 Unchanged Same as the text before. Article 34 in this text
  7. 2 Oct 2026 Council textST 13886/26 Unchanged Same as the text before. Article 34 in this text
  8. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before. Article 34 in this text

Paragraph 1

Changed by the Commission

Parliament amendments 6

1 would delete the wording and 5 propose alternative wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DRenewECRPfE
− Deletion1····
~ Alternative·2112

By political group

  • − Deletion The Left 1
  • ~ Alternative S&D 2 Renew 1 ECR 1 PfE 2

Show

  1. 493 Alternative Virginie JoronPfE · IMCO “Processors shall continue to document personal data breaches that are not notified.”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.’ Processors shall continue to document personal data breaches that are not notified.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    EUDPR Article 34(1)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2018/1725 / Article 34 – paragraph 1
  2. 1671 Deletion Pernando Barrena ArzaThe Left · ITRE–LIBE Deletes the Commission’s wording

    7. in Article 34, paragraph 1 is replaced by the following 1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.’

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    EUDPR Article 34(1)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2018/1725 / Article 34 – paragraph 1
  3. 1672 Alternative Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Controllers shall continue to document non-notified personal data breaches.”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay. Controllers shall continue to document non-notified personal data breaches.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    EUDPR Article 34(1)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2018/1725 / Article 34 – paragraph 1
  4. 1673 Alternative Elena Sancho Murillo +8S&D · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    EUDPR Article 34(1)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 34 – paragraph 1
  5. 1674 Alternative Irena Joveva +5Renew · ITRE–LIBE “In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    EUDPR Article 34(1)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2018/1725 / Article 34 – paragraph 1
  6. 1675 Alternative Marina Kaljurand +6S&D · ITRE–LIBE “In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann
    Group
    S&D
    Targets
    EUDPR Article 34(1)
    Document
    ITRE–LIBE amendments 1565–1740 to the draft report
    Printed header
    Article 4 – paragraph 1 – point 7 / Regulation (EU) 2018/1725 / Article 34 – paragraph 1