GDPR: a personal data breach goes to the authority within 72 hours.
Controllers notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, where feasible, and give reasons for any delay. Here is the obligation at a glance.
Who must report
- Controllers notify the supervisory authority; in Germany, each federal state has its own authority and reporting channel.
- Data subjects are informed under Article 34 unless an exception under Article 34(3) applies.
- Providers of publicly available telecommunications services notify the BNetzA and the BfDI (§ 169 TKG, Regulation (EU) No 611/2013).
The deadlines
| Step | Deadline |
|---|---|
| Notification to the supervisory authority | within 72 hours of becoming aware, where feasible; if later, with reasons for the delay (Article 33(1)) |
| Further information | in phases, as it becomes available (Article 33(4)) |
| Communication to data subjects | under Article 34, subject to the exceptions in Article 34(3) |
| Breach register | every breach, including those not notified (Article 33(5)) |
| Telecom: BNetzA and BfDI | within 24 hours of detection, where feasible; a second notification within three days |
What the Reporting Desk does
The GDPR module times each breach, drafts the notification with the information listed in Article 33(3) and keeps the breach register.
GDPR breachesGeneral information on Articles 33 and 34 of Regulation (EU) 2016/679 and § 169 TKG, as of October 2026. Not legal advice.