# GDPR breach notification — the 72-hour clock and what it covers

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_d270e7de0b-gdpr-breach-notification-the-72-hour-clock-and-what-it-covers
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Data Breach Notification](https://support.icompaas.com/support/solutions/62000112443) › [Topics](https://support.icompaas.com/support/solutions/folders/f_gen_62000112443_topics)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

GDPR Articles 33 & 34 · for Data Controllers and Processors

### What counts as a "personal data breach"

GDPR defines a breach as _"a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed"_. It is broader than most engineers expect: a deleted database table, an admin who shoulder-surfs a screen, a misdirected email — all qualify.

### 72 hours from _awareness_

The clock starts when you have a _reasonable degree of certainty_ that a breach has occurred — not when investigation ends. If you cannot provide all information within 72 hours, file an initial notification and supplement it.

### Who you must notify

-   **The competent Supervisory Authority** — typically your lead SA under the one-stop-shop, plus any SAs of materially affected member states.
-   **Affected individuals** — "without undue delay" if the breach is likely to result in a _high risk_ to their rights and freedoms. Three exceptions apply (technical measures rendering data unintelligible, subsequent measures eliminating risk, disproportionate effort).
-   **Your customers**, if you are acting as a Processor — see your DPA for the contractually agreed window (often 24–48h).

### What goes in the notification

1.  Nature of the breach: categories & approximate numbers of data subjects and records.
2.  Contact point (DPO or representative).
3.  Likely consequences.
4.  Measures taken or proposed to address it and mitigate effects.

### The iCompaas breach workflow

The Privacy module includes a Breach Notification playbook that walks responders through the GDPR-required fields, generates a draft Supervisory Authority report (per-country format), keeps an audit trail of who decided what when, and produces an individual notification template that legal can sign off.

### Related

-   [HIPAA Breach Notification Rule](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_d270e7de0b-gdpr-breach-notification-the-72-hour-clock-and-what-it-covers#)
-   [India DPDP breach notification](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_d270e7de0b-gdpr-breach-notification-the-72-hour-clock-and-what-it-covers#)
-   [Filing with the ICO, CNIL, or your local SA](https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_d270e7de0b-gdpr-breach-notification-the-72-hour-clock-and-what-it-covers#)

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Breach notification under Articles 33 and 34: the 72-hour clock, what to record and when to notify individuals.
- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The HIPAA Breach Notification Rule timelines and thresholds for covered entities and business associates.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): Breach reporting duties to the Data Protection Board and affected Data Principals under the DPDP Rules.