72-hour breach notification
Definition
Breach notification is the duty to inform the supervisory authority of a personal data breach, within 72 hours under the GDPR and three working days under the LGPD.
Under GDPR Art. 33, the controller notifies the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to individuals. Late notifications must explain the delay, and information may be provided in phases. Art. 34 adds communication to the affected people when the risk is high. Processors must inform the controller without undue delay.
In Brazil, LGPD Art. 48 and ANPD Resolution CD/ANPD 15/2024 require the controller to report to the ANPD, and to inform data subjects, within three working days of becoming aware of an incident that may cause relevant risk or damage. The notice describes the nature of the data, the people affected, the measures taken and the remaining risks, and can be complemented later.
The clock starts at awareness, so organisations need an internal escalation path, a risk assessment template and a register of all incidents. Example: a company that confirms on a Monday that a backup was exposed must meet both deadlines if it serves European and Brazilian customers.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 4: Security and breaches.
Primary sources
- GDPR Arts. 33-34
- LGPD Art. 48
- Resolução CD/ANPD nº 15/2024