The GDPR 72-Hour Rule
Article 33 of the GDPR requires data controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it. This tight timeline demands preparation, automation, and clear procedures.
What Constitutes a Reportable Breach?
A personal data breach is a security incident that leads to:
- Destruction of personal data (accidental or unlawful)
- Loss of personal data (inability to access)
- Alteration of personal data (unauthorized modification)
- Unauthorized disclosure or access to personal data
Exception: If the breach is unlikely to result in a risk to individuals' rights and freedoms, notification is not required. Document your risk assessment regardless.
The 72-Hour Playbook
Hour 0-4: Detection and Initial Assessment
- Confirm the breach occurred
- Classify the type and scope
- Identify affected data categories
- Activate incident response team
Hour 4-12: Impact Assessment
- Estimate number of affected individuals
- Assess risk to data subjects' rights
- Determine if the breach is reportable
- Begin containment measures
Hour 12-48: Investigation and Documentation
- Determine root cause
- Document timeline of events
- Assess effectiveness of containment
- Prepare notification content
Hour 48-72: Notification
- Submit notification to supervisory authority
- Include: nature of breach, categories of data, number of individuals, likely consequences, measures taken
- If full information isn't available, notify in phases
Post-72 Hours: Data Subject Notification
If the breach poses a high risk to individuals:- Notify affected individuals without undue delay
- Use clear, plain language
- Describe the breach and its consequences
- Recommend protective measures
Notification Requirements
To Supervisory Authority (Article 33)
- Nature of the breach
- Contact details of DPO
- Likely consequences
- Measures taken or proposed
- Categories and approximate number of individuals
To Data Subjects (Article 34)
- Description of the breach in clear language
- DPO contact details
- Likely consequences
- Measures taken and recommended individual actions
Where SuperClue Fits
GDPR is not one of SuperClue's framework scans, but SuperClue maps scan findings to 99 GDPR controls in its compliance posture view. On servers running the SOC agent, it detects breach patterns and keeps an incident timeline you can use for your 72-hour notification.