Short answer
A controller must document every personal-data breach. It must notify the competent data-protection authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to create a risk to people's rights and freedoms. It must also communicate directly to affected people without undue delay where the breach is likely to create a high risk, unless an Article 34 exception applies. A processor must tell its controller without undue delay after becoming aware.
Notification and compensation are different tests. Article 82 compensation requires a GDPR infringement, material or non-material damage, and a causal link between them. A breach or other infringement alone is insufficient. But EU law does not permit a minimum “seriousness” threshold for non-material damage. Well-founded fear that exposed data will be misused may qualify; purely hypothetical concern without proven damage does not automatically qualify.
Regulatory enforcement, security fault and civil compensation therefore require related but separate evidence and conclusions.
First ask whether there is a personal-data breach
Article 4(12) GDPR defines a breach as a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It covers three dimensions: confidentiality, availability and integrity. A ransomware event that makes records unavailable, an email sent to the wrong recipient and unauthorised alteration of account data can all qualify.
The organisation should establish an incident process that brings suspected events promptly to a team capable of deciding whether personal data were compromised. Under the adopted , awareness normally exists when the controller has a reasonable degree of certainty that a security incident has compromised personal data. Deliberately postponing investigation does not safely postpone the clock.
What must be documented?
Article 33(5) requires records of every breach, including the facts, effects and remedial action. That duty applies even when the controller decides that authority or individual notification is unnecessary. The record should support the risk assessment and explain when awareness arose, what information was available, which measures were taken, and why notification was or was not required.
The file should identify affected systems, data types, approximate people and records, recipients or attackers, duration, reversibility, likely consequences and mitigation. It should preserve changing assessments rather than rewriting the first timeline after the event.
When must the supervisory authority be notified?
Article 33(1) requires notification:
“without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to create a risk to natural persons. —
The controller assesses likelihood and severity objectively. Relevant factors include the data's sensitivity and identifiability, volume, number and vulnerability of people, ease of misuse, permanence, confidentiality protections and likely physical, financial, reputational or social consequences. Effective encryption with uncompromised keys may reduce risk; the mere label “encrypted” is not enough.
If notification is required but full facts are unavailable, Article 33 permits information in phases without undue further delay. Missing the 72-hour point does not remove the duty: notify and explain the delay. The notice must describe the breach, contact point, likely consequences and measures taken or proposed.
The exception is narrow: unlikely to result in a risk, not “no harm has yet been reported”. The controller bears accountability for that conclusion.
When must affected people be told?
Article 34 uses a higher threshold:
Communication is required when the breach “is likely to result in a high risk to the rights and freedoms of natural persons”. —
The communication must be in clear, plain language and describe the breach, contact point, likely consequences and protective measures. It should give useful actions—such as resetting credentials, monitoring a payment account or disregarding a targeted message—rather than generic reassurance.
Direct communication is not required where effective prior measures make the data unintelligible to unauthorised people, later measures ensure the high risk is no longer likely to materialise, or individual contact would involve disproportionate effort and an equally effective public communication is made. A supervisory authority may review that assessment and require communication.
Security failure, regulatory action and damages are distinct
A successful cyberattack does not by itself prove that Article 32 security was inappropriate. In Natsionalna agentsia za prihodite, the Court of Justice held that unauthorised access by a third party is not sufficient, on its own, to establish that the controller's technical and organisational measures were inappropriate. Courts must assess the measures against risks, state of the art, implementation costs, processing context and likely severity.
Conversely, blaming an attacker does not automatically excuse the controller. Article 82(3) exempts a controller only if it proves it was not in any way responsible for the event giving rise to damage. A controller that made the breach possible through a GDPR failure may remain liable. Regulators may separately order remediation or impose an administrative fine under Articles 58 and 83; those enforcement purposes differ from compensating an individual.
When is compensation available?
Article 82 covers both material damage, such as financial loss, and non-material damage, such as proven loss of control or fear of misuse. In Österreichische Post, the Court identified:
infringement of the GDPR, damage suffered, and a causal link between them, “those three conditions being cumulative”. —
The mere infringement does not create compensation automatically. The claimant must establish actual damage and causation under applicable national procedural rules, provided those rules respect EU-law equivalence and effectiveness.
At the same time, a Member State cannot require non-material damage to cross a minimum seriousness threshold. Even limited harm can qualify if it is real and caused by the infringement. Article 82 is compensatory, not punitive: the award should fully and effectively compensate proven damage, while national law supplies quantification rules within EU constraints.
How do courts assess fear of future misuse?
In Natsionalna agentsia za prihodite, the Court held that fear of possible future misuse can itself constitute non-material damage. The national court must determine whether the fear is well founded in the particular circumstances and for that individual. Factors may include the data's sensitivity, public exposure, evidence of access, realistic misuse routes, duration and protective steps.
That ruling does not turn every concern into damages. In MediaMarktSaturn, the Court confirmed that infringement alone is insufficient and that purely hypothetical misuse does not establish damage automatically. Evidence should connect the particular breach to a real adverse consequence, including a well-founded fear, rather than rely only on abstract possibility.
Later judgments sharpen that evidential point. In AT and BT, the Court held that fear that data were disclosed may qualify even where disclosure cannot be established, provided the fear and its negative consequences are duly proved. In Quirin Privatbank, it confirmed that fear or annoyance caused by loss of control, potential misuse or reputational harm can be non-material damage where the claimant proves those feelings, their negative consequences and causation. The controller's degree of fault cannot be used to set compensation for non-material damage, and a preventive injunction cannot reduce the financial compensation due for damage already suffered.
An operational checklist
- Confirm whether personal data suffered a confidentiality, integrity or availability breach.
- Record when reasonable certainty—and therefore awareness—arose.
- Contain the event while preserving evidence and an auditable timeline.
- Assess risk by likelihood and severity for the people affected.
- Notify the authority within 72 hours where risk is not unlikely; explain delay and phase information if needed.
- Communicate clearly to people where high risk is likely, unless an Article 34 exception is evidenced.
- Record every breach and the reasoning even where no external notice is sent.
- Preserve proof of security measures, mitigation, actual damage claims and causation separately.
- Check parallel sectoral, contractual and national incident-reporting duties.
Conclusion
The GDPR uses a graduated response: record every breach, notify the authority when risk is possible rather than unlikely, and tell affected people when high risk is likely. Those forward-looking risk tests should not be confused with Article 82's retrospective compensation test. Damages require infringement, actual material or non-material harm and causation. There is no seriousness floor, but there is also no automatic payment for a breach: courts examine the evidence, including whether fear of misuse is genuine and well founded.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.