Breach notices

Data breach and incident notification in the European Union

Last checked 7 November 2026 · 5 sources

Short answer

The EU has several overlapping notice duties. Under the GDPR, a controller tells the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach ¹. NIS2 requires an early warning within 24 hours of a significant incident, a notification within 72 hours and a final report within one month ². Telecoms providers report personal data breaches within 24 hours of detection ⁴. Financial entities follow DORA, which has applied since 17 January 2025 ³.

GDPR authority deadline: 72 hours where feasible, with reasons if later ¹
GDPR notice to people: Without undue delay when the risk is high ¹
NIS2 early warning: 24 hours after becoming aware of a significant incident ²
NIS2 final report: One month after the incident notification ²
Telecoms providers: 24 hours after detection, where feasible ⁴
DORA start date: 17 January 2025 ³

The GDPR duty: Articles 33 and 34

The General Data Protection Regulation has applied since 25 May 2018 ¹. Article 33 says the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach ¹. No notice is needed where the breach is unlikely to result in a risk to the rights and freedoms of natural persons ¹. A late notice must carry reasons for the delay ¹.

A processor does not report to the authority under Article 33. It must notify the controller without undue delay after becoming aware of the breach ¹. Information can be given in phases where it is not all available at once ¹. The controller must document every breach, its effects and the remedial action taken, so the authority can check compliance ¹.

Article 34 covers the people affected. When a breach is likely to result in a high risk to them, the controller must tell them without undue delay, in clear and plain language ¹.

Exception 1: the data was protected by measures such as encryption that make it unintelligible to anyone not authorised to access it ¹.
Exception 2: the controller has taken later measures so the high risk is no longer likely to materialise ¹.
Exception 3: individual notice would involve disproportionate effort. A public communication or similar measure is then used instead ¹.
The authority can require the controller to tell people, or decide that an exception applies ¹.

NIS2: incident reporting for critical sectors

Directive (EU) 2022/2555, known as NIS2, was adopted on 14 December 2022 ². Member States had to adopt and publish national measures by 17 October 2024 and apply them from 18 October 2024 ². NIS2 repealed the earlier NIS Directive 2016/1148 from 18 October 2024 ².

NIS2 reports go to the national CSIRT or competent authority and concern significant incidents, not only personal data ². The CSIRT or authority should reply within 24 hours of the early warning where possible, with initial feedback ². Trust service providers must notify within 24 hours of becoming aware of a significant incident affecting their trust services ².

NIS2 stage	Deadline	Content
Early warning	Within 24 hours of becoming aware ²	Whether unlawful or malicious acts are suspected and any cross-border impact ²
Incident notification	Within 72 hours of becoming aware ²	Initial assessment of severity and impact, and indicators of compromise where available ²
Final report	Not later than one month after the incident notification ²	The items listed in point (d) of Article 23(4) ²
Progress report	When the incident is ongoing at the final report date ²	Final report within one month of handling the incident ²

Fines for missed notices

Under GDPR Article 83(4), breaches of the controller and processor duties in Articles 25 to 39 can bring fines up to EUR 10,000,000 or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher ¹. Articles 33 and 34 fall within that range of articles ¹.

Under NIS2, Member States must set maximum fines of at least EUR 10,000,000 or 2% of worldwide turnover for the Directive's top tier of entities that break the reporting duty in Article 23 ². For important entities, the minimum maximum is EUR 7,000,000 or 1.4% of worldwide turnover ².

Telecoms and financial firms

Providers of publicly available electronic communications services follow Commission Regulation (EU) No 611/2013 of 24 June 2013 ⁴. They must notify all personal data breaches to the competent national authority, no later than 24 hours after detection where feasible ⁴. If information is missing, they can send an initial notice within 24 hours and a second notice within three days after the initial one ⁴.

Financial entities report major ICT-related incidents under the Digital Operational Resilience Act, Regulation (EU) 2022/2554, which applies from 17 January 2025 ³. DORA sets three stages: an initial notification, an intermediate report and a final report once the root cause analysis is complete ³. Significant credit institutions report to their national competent authority, which passes the report to the ECB ³. The European Supervisory Authorities must publish a yearly anonymised report on major ICT-related incidents ³.

Guidance from the EDPB

The European Data Protection Board publishes Guidelines 9/2022 on personal data breach notification under the GDPR ⁵. The current text is version 2.0, which followed a public consultation on version 1 with comments due by 29 November 2022 ⁵. The Board publishes a short summary as well, titled Guidelines at a Glance: personal data breaches, what to do ⁵.

Common questions

How long does a company have to report a data breach in the EU?

Without undue delay and, where feasible, within 72 hours of becoming aware of it, under GDPR Article 33 ¹.

Does every breach have to be reported to the regulator?

No. A breach that is unlikely to result in a risk to people's rights and freedoms does not need to be notified, but it must still be documented ¹.

When must affected people be told under the GDPR?

When the breach is likely to result in a high risk to them, without undue delay ¹.

What is the NIS2 24 hour early warning?

A first alert to the CSIRT or authority within 24 hours of becoming aware of a significant incident, followed by a 72 hour notification and a final report ².

Which rule applies to banks and insurers?

DORA, which applies from 17 January 2025 and requires initial, intermediate and final reports on major ICT-related incidents ³.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.

Sources

Data breach notification laws compared
How breach notice rules differ in the EU, UK, US, Australia, Canada and India: who must notify, the deadline and who receives the notice.
Data breach and incident notification in the United Kingdom
UK breach reporting duties under the UK GDPR, the Data Protection Act 2018, PECR and the NIS Regulations, with deadlines and fine caps.
How to check whether a notice was given
Where to look up official notices: state breach lists, the HHS breach portal, SEC EDGAR, FDA warning letters, FCA notices, WARN reports and recall lists.
What a formal notice is
What makes a notice formal: who gives it, who receives it, the deadline and the form. Breach, recall, regulatory, layoff and court notices compared.