72 hours, from awareness
A personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. Later than that, the notification must explain the delay.
Why it is like this
Authorities needed to hear about breaches while they can still influence the outcome, and a fixed short clock prevents the investigation from becoming the delay.
Not to be confused with
72 hours from the incident, from containing it, or from being certain. Awareness means a reasonable degree of certainty that a breach occurred — not a finished forensic report. A notification may be made in phases.
In practice
Detected Friday 18:00 → due Monday 18:00. Hours, not working days. If the facts are incomplete, notify with what you have and supplement.
Source: Regulation (EU) 2016/679 (GDPR) — Article 33. Read on .
Predict Check yourself
A breach is detected at 18:00 on Friday. Forensics will not conclude before the following Wednesday. When is the notification due?
Show the answer
Monday 18:00 — the clock is calendar hours from awareness, and an incomplete notification can be supplemented in phases.
The clock does not pause for investigation. Article 33(4) exists precisely so you can notify on time with partial information.