The GDPR 72 hour rule requires a controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Brazil sets 3 business days for notifying the ANPD. This calculator turns the awareness time into dated deadlines and lists what each notification must contain.
How to use
- Enter the date and time at which the organisation became aware of the breach.
- Tick the notifications that apply: supervisory authority, ANPD, data subjects, controller or a contractual deadline.
- Say whether the breach could cause high risk and list any public holidays in the period.
- Read the deadlines, the status of each one and the content checklist; export to PDF, DOCX or CSV.
What each field asks for
| Field | What to enter |
|---|---|
| When the organisation became aware of the breach | Local date and time at which you had reasonable certainty that personal data was affected. |
| Notifications that apply | Tick the laws and recipients in your case. LGPD counts business days; GDPR counts clock hours. |
| Could the breach cause high risk or relevant harm to individuals? | Decides whether data subjects must be told and whether notifying the authority is required. |
| Another deadline, in clock hours (optional) | For a contract, a sector rule or the law of another country. |
| Name of that other deadline (optional) | E.g. client contract |
| Public holidays to skip in the business day count (optional) | Format YYYY-MM-DD, one per line. Saturdays and Sundays are already left out. |
Example
A fictional retailer finds on Friday 9 October 2026 at 17:30 that a customer spreadsheet was exposed, with high risk for the people concerned. With the Monday 12 October holiday entered, the calculator shows the GDPR deadline on 12 October at 17:30 (72 clock hours) and the LGPD deadline, for the ANPD and the data subjects, on 15 October at 23:59, the third business day. European data subjects must be told without undue delay.
When to use
- Right after a breach is confirmed, to organise the response around the correct dates.
- In an incident response exercise, to train the team with realistic deadlines.
- When the company operates in Europe and Brazil and must meet GDPR and LGPD at the same time.
- For processors that must inform the client controller within the contractual deadline.
Frequently asked questions
When does the GDPR 72 hour clock start?
It starts when the controller becomes aware of the breach, meaning it has a reasonable degree of certainty that a security incident has compromised personal data. A first technical alert is not always awareness, so record how and when certainty was reached.
Do weekends count in the 72 hours?
Yes. The 72 hours are clock hours, so weekends and public holidays count. If you notify after 72 hours, the notification must give the reasons for the delay.
What is the deadline under Brazil's LGPD?
Resolution CD/ANPD No. 15/2024 sets 3 business days to notify the ANPD and the data subjects when the incident may cause relevant risk or harm. This calculator starts counting on the day after awareness and skips weekends and the holidays you enter. Always check the rule currently in force.
When must data subjects be told?
Under GDPR Article 34, when the breach is likely to result in a high risk to their rights and freedoms, without undue delay. Under LGPD, the ANPD regulation requires communication to data subjects within the same 3 business days when there is relevant risk or harm.
Can I notify before I have all the facts?
Yes. Notify within the deadline with what you know and provide the rest later. GDPR allows notification in phases, and the ANPD also accepts supplementary information.
Which DPCert certification covers this topic?
The DPAI (Data Protection & AI Professional) assesses security and breaches in its security domain, alongside data protection foundations, data subject rights and accountability tools.
Is this tool legal advice?
No. It is an educational tool and the deadlines are indicative. Check the rules currently in force and validate the decision with your data protection officer and legal counsel.