Verified Confidence: high
Primary source found; it says the same thing, the scope matches, and it is reasonably current.
Safe rephrasing
GDPR requires controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to pose a risk.
What the source says
the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority
European Union (GDPR Art. 33) — Regulation (EU) 2016/679, Article 33
- Commonly cited as
- "GDPR's 72-hour breach rule"
- True origin
- European Union (GDPR Art. 33) — Regulation (EU) 2016/679, Article 33
- Type
- Reference fact: A frequently needed number or rule taken directly from a primary source (e.g. Pew, Census, IAB/PwC, FTC), with its as-of date.
- Year
- 2016 (applies since May 2018)
- Data as of
- In force
- Last checked
- Method & sample
- Text of the regulation (via gdpr-info.eu).
- Drift between quote and source
- Not required if the breach is unlikely to result in a risk to people; late notices need reasons
- Interest
- n/a (statutory or regulatory text).
Sources we opened
- GDPR Art. 33 (gdpr-info.eu) primary