GDPR Articles 33 and 34: breach notification
The GDPR requires personal data breaches to be reported to the regulator within 72 hours and, where risk is high, to affected people without undue delay.
Article 33
Notify the supervisory authority without undue delay and where feasible within 72 hours, unless the breach is unlikely to result in risk; explain any delay.
Article 34
Inform affected people in clear language when the risk to them is high.
Reputation
Timely, honest notification reduces both enforcement risk and loss of trust.
General information, not legal advice. In real cases we work alongside lawyers who specialise in digital rights.
Frequently asked questions
What applies in Turkey?
Under the KVKK the Board also applies 72 hours; see [KVKK Article 12](/en/laws/turkey-kvkk-article-12/).