Article 33 – Notification of a personal data breach to the supervisory authority

In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Until the establishment of the national entry point pursuant to Article 23b of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56 of this Regulation.

The Board shall establish and make public a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk. The lists shall be available by [OP date = nine months from the date of entry into application of this Regulation].

The lists referred to in paragraph 6 shall be reviewed by the Board at least every three years and updated where necessary.

The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1. That proposal shall be submitted to the Commission by [OP date = nine months from the date of entry into application of this Regulation]. The Commission after due consideration of the proposal reviews it and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

The template referred to in paragraph 8 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposal reviews it and is empowered to adopt any updates by way of an implementing act in accordance with the examination procedure set out in Article 93(2).’