Article 33. Notification of a personal data breach to the Centre
(1) In the case of a personal data breach, the controller shall notify the Centre thereof without undue delay and, where possible, not later than 72 hours from the date on which it became aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, it shall be accompanied by a reasoned explanation of the delay.
(2) The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
(3) The notification referred to in paragraph (1) shall at least:
- a) describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
- c) describe the likely consequences of the personal data breach;
- d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where applicable, measures to mitigate its possible adverse effects.
(4) Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue delay.
(5) The controller shall keep documents relating to all cases of personal data breach, comprising a description of the factual situation in which the personal data breach occurred, of its effects and of the remedial action taken. That documentation shall enable the Centre to verify compliance with this Article.