The Clock Starts at "Awareness," Not Confirmation
Under the General Data Protection Regulation (GDPR) — Europe's comprehensive privacy law that applies to any organization handling EU residents' data, regardless of where the company is headquartered — you do not have weeks to investigate a breach before telling anyone.
Article 33 of GDPR states that a data controller must notify the relevant supervisory authority (e.g., the ICO in the UK, the CNIL in France) without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach.
What Does "Aware" Actually Mean?
This is the most operationally critical definition in the regulation. The 72-hour clock does not start when you have completed your forensic investigation. It starts when you have a reasonable degree of certainty that a breach has occurred — even if you don't yet know the full scope.
Consider these scenarios:
| Scenario | Clock Started? |
|---|---|
| A security researcher emails: "I have your user database." | Yes. You have reasonable certainty. |
| An engineer notices anomalous outbound traffic but can't explain it. | Not yet — but you must investigate immediately. If investigation confirms a breach, the clock starts at the moment of that confirmation, not when you finish the full investigation. |
| A third-party vendor notifies you that their system (which holds your data) was breached. | Yes. The clock starts when you receive that notification. |
| You find a misconfigured S3 bucket that was publicly readable for 30 days. | Yes. The moment you discover the misconfiguration and confirm it contained personal data. |
The practical implication: do not delay confirming a breach hoping the clock hasn't started. Regulators treat deliberate delay in confirmation as an aggravating factor. Investigate fast, confirm fast, notify fast.
What the Notification Must Contain
A GDPR Article 33 notification to the supervisory authority must include, to the extent possible:
- Nature of the breach — what happened, what data was affected, approximate number of individuals.
- Contact details of the Data Protection Officer (DPO) or other contact point.
- Likely consequences of the breach.
- Measures taken or proposed to address the breach and mitigate its effects.
Critically, GDPR explicitly allows you to provide this information in phases if you don't have everything within 72 hours. You can submit an initial notification with what you know, then follow up with additional details. This is far better than waiting until you have the complete picture.
The Consequences of Missing the Deadline
Fines under GDPR can reach €20 million or 4% of global annual turnover, whichever is higher. But the fine for a late notification is often separate from — and in addition to — the fine for the underlying breach itself. Companies have been fined specifically for the notification failure, even when the underlying breach was relatively minor.
A common interview question for engineering leadership roles: "Walk me through how you'd handle a data breach notification." The expected answer demonstrates knowledge of the 72-hour rule, the distinction between "aware" and "fully investigated," the phased notification option, and the parallel tracks of legal notification vs. customer communication. Candidates who only describe the technical remediation steps — without mentioning regulatory obligations — signal they haven't operated at the level where legal consequences are real.