EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

Article 33

Source
JURI-AM-790236, page 145 pp. 145–147

Amendments as tabled

Four amendments, each tabled separately · JURI amendments 69–296 to the draft opinion

  1. 251 Alternative Daniel BudaEPP · JURI “electronic channel made available by the competent supervisory authority or, if the competent Member State has so decided, via a national contact”

    (1) In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entryelectronic channel made available by the competent supervisory authority or, if the competent Member State has so decided, via a national contact point establishedor pursuantan tointerface interoperable with the framework provided for in Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.’

    Tabled by
    Daniel Buda
    Group
    EPP
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 (GDPR) / Article 33 – paragraph 1
  2. 252 Alternative Ton Diepeveen +1PfE · JURI “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entrysingle pointintegrated establishednational pursuantreporting to Article 23a of Directive (EU) 2022/2555portal to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 8 – point a
  3. 253 Alternative Daniel BudaEPP · JURI “and until the applicable channel is designated by the competent Member State”

    1a. Until the establishment and testing of the single-entryinteroperable pointframework pursuantprovided tofor in Article 23a of Directive (EU) 2022/2555 and until the applicable channel is designated by the competent Member State, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.’

    Tabled by
    Daniel Buda
    Group
    EPP
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / 2016/679 (GDPR) / Article 33 – paragraph 1 a
  4. 254 Alternative Ton Diepeveen +1PfE · JURI “controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article…”

    1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 8 – point b