Law note · European Union
GDPR Articles 33-34, Breach Notification
Article 33(1) requires the controller to notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk individuals' rights and freedoms, and a processor must notify its controller without undue delay.
Article 34 requires notice to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless the exposed data was rendered unintelligible, for example by strong encryption, or the controller has since eliminated the high risk.
What it asks of an app
- Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms.
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679