GDPR Art.33: Notifying the DPA Within 72 Hours

GDPR Art.33 is clear: in the event of a personal data breach, the data controller must notify the supervisory authority (the CNIL in France, the ICO in the UK, etc.) within 72 hours of becoming aware of it. Not 72 hours after finishing the investigation. Not 72 hours after the crisis meeting. 72 hours after becoming aware. This deadline is a technical and organizational challenge that many underestimate.

What constitutes a data breach under GDPR?

Art.4(12) defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data." In practice, three types:

• Confidentiality breach: unauthorized access to personal data. Example: customer database exposed on the internet, email sent to the wrong recipient, compromise by an attacker.

• Integrity breach: unauthorized alteration of data. Example: ransomware encrypting a patient database, malicious modification of HR records.

• Availability breach: loss of access to data. Example: server crash without backup, DDoS attack making data inaccessible, accidental destruction.

Important point: not every data breach is necessarily notifiable. Art.33 requires notification unless "the breach is unlikely to result in a risk to the rights and freedoms of natural persons." If the data was encrypted with a robust algorithm and the key wasn't compromised, the risk may be considered nil. But this assessment must be documented.

The DPA notification process

In France, notification is made via the CNIL's online service (notifications.cnil.fr). The form asks for:

• Nature of the breach: type (confidentiality/integrity/availability), cause, attack vector

• Categories of data: what data is affected (identity, contact, financial, health, etc.)

• Number of individuals affected: estimate if the exact figure isn't known

• Likely consequences: potential impact on individuals (identity theft, financial loss, etc.)

• Measures taken: containment, remediation, and prevention actions

• DPO contact: Data Protection Officer coordinates

The notification can be made in two stages: an initial notification within 72 hours with available information, then a supplementary notification as the investigation reveals new details. Regulators explicitly accept this phased approach.

The 72-hour challenge

Let's break down the realistic timeline:

• T+0h: breach detected. The 72-hour clock starts here, not when the attack occurred, but when you became aware.

• T+0 to T+6h: incident confirmation, initial scope assessment, identification of affected data

• T+6 to T+24h: technical investigation (initial forensics), estimation of affected individuals, risk assessment

• T+24 to T+48h: drafting the notification report, legal and DPO validation

• T+48 to T+72h: submission to the DPA, notification to individuals if required (Art.34)

The bottleneck is almost always the same: detection. With an average dwell time of 194 days (IBM 2025), most organizations miss the 72-hour deadline because they don't detect the breach in time, not because they can't draft the report fast enough.

Notification to individuals (Art.34)

If the breach is "likely to result in a high risk to the rights and freedoms" of individuals, you must also notify the affected people. In clear, understandable terms, explaining:

• The nature of the breach

• The data concerned

• The likely consequences

• Measures taken and recommendations (change password, monitor bank accounts, etc.)

Exception: individual notification isn't required if the data was encrypted, if measures eliminated the risk, or if it would require disproportionate effort (in which case, public communication).

Penalties for non-notification

Failure to comply with Art.33 is sanctioned under Art.83(4): fines up to EUR 10M or 2% of global revenue. In practice, DPAs regularly sanction notification failures. Recent examples:

• Hospital group: EUR 800,000 for late notification and insufficient security measures

• Telecom operator: EUR 300,000 for failure to notify within 72 hours

• Startup: EUR 150,000 for failure to notify despite a leak of 500,000 accounts

Regulators look at two things: did you notify on time? And did you have appropriate security measures to detect the breach?

How ThreatClaw automates detection and reporting

ThreatClaw tackles the problem from both sides:

Automatic personal data detection

• Identification of personal data flows in your infrastructure

• Automatic data classification (identity, financial, health) through database and flow analysis

• Real-time alerting if personal data is exposed (public S3 bucket, unauthenticated database, API without access control)

Breach detection

• Continuous monitoring of access to databases containing personal data

• Exfiltration detection (abnormal query volume, transfers to unusual destinations)

• Correlation with compromise indicators (is the access from a compromised account?)

Art.33 report generation

• Pre-filled report in the required format within 15 minutes of detection

• Automatic scope estimation (affected tables, record count, data categories)

• Technical incident timeline

• The DPO receives a complete package for validation, not a raw alert to investigate

What used to take 24-48 hours of manual investigation is available in 15 minutes. The 72 hours become a comfortable deadline instead of a race against the clock.

The overlap with NIS2

If your organization is also covered by NIS2, you have a dual notification obligation. NIS2 Art.23 requires a CSIRT alert within 24 hours (stricter than GDPR). ThreatClaw generates both reports simultaneously, the DPA format (GDPR Art.33) and the CSIRT format (NIS2 Art.23).

FAQ

Is an email sent to the wrong recipient a notifiable breach?

It depends. If the email contains sensitive personal data (health, financial) and the recipient isn't a trusted party, yes, it's likely a notifiable confidentiality breach. If it's an internal email with a first name, the risk is minimal. In all cases, document the incident in your breach register (Art.33(5) obligation) even if you don't notify the DPA.

Does the 72-hour deadline apply on weekends and holidays?

Yes, without exception. 72 calendar hours, not business hours. This is why continuous monitoring and automated detection are essential, breaches don't choose their timing.

What happens if I exceed 72 hours?

You must still notify, explaining the reasons for the delay (Art.33(1)). A justified delay (complex investigation, large-scale incident) will be viewed more favorably than total absence of notification. But regulators appreciate timely compliance, it's a factor in penalty calculations.

Do I need to notify the DPA if the data was encrypted?

If encryption is robust (AES-256, key not compromised) and the exfiltrated data is unexploitable, the risk to individuals is nil and notification isn't required. But you must document this assessment. If you have any doubt about encryption strength or key compromise, notify. Regulators prefer a "precautionary" notification over an unjustified non-notification.