In short
The 72 hours start when you have a reasonable degree of certainty that personal data has been compromised, not when you know the cause and extent.
They are calendar hours: weekends and public holidays count, so decision-making, delegation and digital signature must be prepared in advance.
You can notify in phases: a preliminary notification to the Garante with what you know, then one or more supplementary notifications.
Every breach goes in the register, even when you do not notify it, with the reasoning behind the decisions taken.
For NIS2 entities, notification to CSIRT Italia (24 hours, 72 hours, one month) is a separate obligation and does not replace notification to the Garante.
The 72-hour clock starts when you become aware of the breach, not when you have worked everything out. This is the point that most often throws companies into crisis when facing a data breach: they wait for the full picture before acting, and meanwhile time runs out. The GDPR does not ask you to know everything straight away. It asks you to decide quickly, notify what you know and complete the rest later.
In this guide you will find what to do in practice: when the deadline really starts, who decides, how to assess whether to notify the Italian Data Protection Authority (the Garante), what is needed immediately and what can follow, when to inform the people affected and how to keep the breach register. You will also find an hour-by-hour timeline example and a comparison with the incident notification required by NIS2, which is a separate, parallel obligation. If you first need a refresher on general principles and obligations, start with our guide on what the GDPR is.
What is a data breach and when does the notification duty apply?
A data breach is a security breach affecting personal data. Article 4 of the GDPR defines it as a breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. No hacker is needed: an email with an attachment sent to the wrong recipient is as much a data breach as ransomware.
The notification duty is in Article 33. The controller notifies the breach to the supervisory authority, in Italy the Garante per la protezione dei dati personali, without undue delay and, where feasible, within 72 hours of becoming aware of it. The only exception is when the breach is unlikely to result in a risk to the rights and freedoms of individuals. If notification comes after 72 hours, it must be accompanied by the reasons for the delay.
Confidentiality, integrity, availability
The EDPB Guidelines 9/2022 on breach notification classify data breaches into three types, which are useful from the very first hour. A confidentiality breach is unauthorised access or disclosure: an exfiltrated database, a folder shared by mistake. An integrity breach is an unauthorised alteration of data. An availability breach is the loss of access to data or its destruction, even temporarily.
A single incident can involve more than one type. Ransomware that encrypts your servers is an availability breach; if the attacker has also copied the data, it is a confidentiality breach too, with a much higher risk for individuals.
A security incident and a data breach are not the same thing
An attack that takes down your brochure website without touching personal data is a security incident, but it does not trigger Article 33. Conversely, many data breaches have nothing to do with IT: a lost HR file, an unencrypted USB stick left on a train. The question to ask is always the same: is personal data involved? If so, you must at least document the event, even when you conclude it does not need to be notified.
When does the 72-hour clock start?
The 72 hours start when the controller becomes aware of the breach. For the EDPB, this happens when the controller has a reasonable degree of certainty that a security incident has compromised personal data. You do not need to know the cause, the exact number of people involved or the culprit.
Two examples from the guidelines. If you lose a USB stick with unencrypted data, you become aware when you realise it is lost: you may never know whether anyone read it, but the loss is certain. If a cybercriminal demands a ransom and you confirm the attack, you are aware from that moment.
The short investigation period is not a loophole
When you receive a report or an alert, you can carry out a short period of investigation to establish whether a breach has really occurred. During this initial check, according to the EDPB, you are not yet regarded as aware. However, the investigation must begin as soon as possible and serve only to establish whether there has been a breach; detailed analysis comes later.
This is where many companies go wrong. Turning the check into a week-long forensic analysis does not move the starting point: if the breach did occur and you did not act promptly, for the EDPB the notification duty has not been met. The alert must reach someone who can decide straight away.
Weekends and public holidays count
The 72 hours are calendar hours. The EU regulation on time limits (Regulation 1182/71, referred to by the EDPB) states that periods include Saturdays, Sundays and public holidays, unless expressly excluded. A breach discovered on Friday evening reaches its deadline on Monday evening, not Wednesday.
If the person who can sign the notification is unreachable at the weekend, the problem must be solved in advance, with a delegation written into the procedure.
Who decides and who does what in the first hours?
Responsibility for notification always lies with the data controller, the company that determines the purposes and means of the processing. It can delegate the execution, but not the responsibility. That is why the first thing to know, before any incident, is who within the company takes the decision to notify or not.
Controller, processor and DPO
If the breach occurs at a supplier that processes data on your behalf (your cloud ERP, your payroll provider), that supplier is a processor. Article 33(2) requires it to inform you without undue delay, without assessing the risk in your place. According to the EDPB, you generally become aware when the supplier informs you.
The contract with the supplier, required by Article 28, is the right place to set notice times, minimum content and contacts. The supplier can also notify on your behalf if the contract provides for it, but legal responsibility remains yours. If you have a DPO, the EDPB recommends you involve them immediately and throughout the process: their contact details, or those of another contact point, are one of the mandatory elements of the notification.
The response team: minimum roles
An SME does not need a crisis committee, but it does need names. You need at least four functions, even if held by the same person:
who decides: the controller or a delegate with the power to notify and sign;
who investigates: in-house IT or a technical supplier, to contain the incident and gather evidence;
who assesses the risk to individuals: the DPO or privacy lead, with legal support if needed;
who communicates: with the Garante, with data subjects and, if necessary, with clients and partners.
An often overlooked detail: in the Garante's form, the notification is submitted by the legal representative or a delegate, who signs digitally following instructions received by email. Delegation and signature must be set up in advance.
To notify or not? How you assess the risk
Not every breach must be notified to the Garante. The duty applies unless a risk to the rights and freedoms of individuals is unlikely. Communication to data subjects, by contrast, applies only when there is a high risk. There are therefore two thresholds, and the assessment is made case by case.
Three possible outcomes
The EDPB suggests reasoning on three levels: no likely risk, risk, high risk. In the first case you record the breach in the internal register and justify the decision not to notify. In the second you notify the Garante. In the third you notify the Garante and communicate the breach to the people affected.
The factors to consider are concrete: type of data (health, financial, credentials), number of people, ease of identifying them, severity of consequences (identity theft, fraud, discrimination), vulnerable individuals, measures already in place such as data encryption. If the outcome is uncertain, the prudent choice is to notify: the EDPB points out that there is no penalty for notifying an incident that later turns out not to be a breach.
Two cases from the EDPB Guidelines 01/2021
The EDPB Guidelines 01/2021 collect practical cases with the outcome of the assessment. In the first ransomware case, the data is encrypted by the attacker, the logs show there was no exfiltration and the data is quickly restored from an intact backup: the outcome given is internal documentation only, with no notification or communication to data subjects.
In another, a transport company's server is encrypted with no backup and the data is exfiltrated: internal documentation, notification to the authority and communication to data subjects, including public communication for those who cannot be reached. The difference lies not in the attack but in two measures prepared beforehand: verified backups and logs able to show what left the network.
What to notify now and what to complete later
The rule that unlocks the first 72 hours is Article 33(4): if you cannot provide all the information at once, you can provide it in phases, without undue further delay. The EDPB confirms this: an incomplete picture is no reason to postpone notification, and figures can be approximate.
The minimum content of the notification
Article 33(3) sets out what the notification must contain. It describes the nature of the breach, with the categories and approximate number of data subjects and records concerned. It gives the name and contact details of the DPO or another contact point. It describes the likely consequences. It describes the measures taken or proposed to address the breach and mitigate its effects.
Within 72 hours you usually have: what happened, when you discovered it, the systems and types of data involved, an estimate of the number of people, the first containment measures. What often comes later is the technical cause, confirmation of exfiltration, the exact number of records and the final corrective measures.
Preliminary and supplementary notification to the Garante
The Garante's form reflects this logic: for the first notification you choose between complete and preliminary. The preliminary notification is meant precisely for when you start the process without a full picture, committing to supplement it. With the supplementary notification you add the missing information using the file number and PIN received by email at the end of the first notification.
Keep that email and state from the first notification that further information will follow, as the EDPB recommends.
How to submit it: the online procedure
Since 1 July 2021, notifications to the Garante must be submitted exclusively through the online procedure available on the Authority's online services portal, reachable from its page dedicated to data breaches. On the same portal you will find a self-assessment tool that helps you understand what actions to take after a breach.
The facsimile of the form published by the Garante cannot be used for submission, but it is useful beforehand: go through it with your team and prepare the stable answers, such as controller details, DPO contacts and a description of your systems.
Example: an hour-by-hour timeline
Take a typical company: a services SME with 60 employees and a client portal. On Friday at 17:30 the supplier that manages the servers reports unusual outbound traffic from the portal database. The table shows a realistic sequence; the internal timings are an example, and the only deadline set by law is the 72 hours.
Time | What happens | Who acts |
|---|---|---|
Fri 17:30 | Alert from the supplier: unusual traffic from the client database. Initial check begins. | IT supplier, IT lead |
Fri 19:00 | Logs confirm unauthorised access to client names, emails and addresses. Hour zero: personal data compromised with reasonable certainty. | IT lead, controller |
Fri 20:00 | Containment: credentials revoked, access closed, logs preserved. DPO informed; entry opened in the register. | IT, DPO |
Sat 10:00 | Risk assessment: around 8,000 clients, no payment data, possible targeted phishing. Notification required. | DPO, controller |
Sat 16:00 | Preliminary notification to the Garante with known data, stating that further information will follow. | Legal representative's delegate, DPO |
Mon 12:00 | Analysis confirms exfiltration: high risk of phishing, communication to clients is prepared. | DPO, IT, communications |
Mon 17:00 | Direct communication to affected clients, with practical advice on spotting fake emails. | Communications, DPO |
Mon 19:00 | The 72 hours from hour zero expire: the notification has already been sent. | — |
Following weeks | Supplementary notification with cause, exact number of records and corrective measures; register updated. | DPO, controller, IT |
Two things to note. First: hour zero is not the 17:30 alert, but the moment when the initial check provides a reasonable degree of certainty. Second: the notification goes out on Saturday with incomplete information, and that is fine. Had the supplier only reported on Tuesday, hour zero for the controller would have been the time of that report: this is why the processor's notice times must be written into the contract.
When must you also inform the people affected?
Article 34 requires you to communicate the breach to data subjects when it is likely to result in a high risk to their rights and freedoms. Communication must be made without undue delay and, in some obvious cases, such as an immediate threat of identity theft, the EDPB accepts that it may even take place before notifying the authority.
The communication uses plain language and contains at least the nature of the breach, the contact details of the DPO or another contact, the likely consequences and the measures taken. Add practical advice: change your password, be wary of emails asking for payment details.
When communication is not required
Article 34(3) provides three cases in which communication to data subjects is not required. First: the data was protected by measures that make it unintelligible to anyone not authorised, such as adequate encryption with an uncompromised key. Second: after the breach you took measures that ensure the high risk no longer materialises. Third: individual communication would involve disproportionate effort; in that case, however, an equally effective public communication is required.
How to communicate well
The EDPB recommends dedicated messages, not included in a newsletter; a press release or a blog post alone is not enough. If your company mailbox has been compromised, using it to warn clients helps anyone trying to impersonate you: choose an uncompromised channel.
The breach register: even when you do not notify
Article 33(5) requires you to document any personal data breach, including the facts, its effects and the remedial action taken. This applies to breaches you do not notify as well: it is precisely this documentation that allows the Garante to verify that your assessment was correct.
The EDPB recommends recording your reasoning too: why you considered the risk unlikely, why you notified late, why you decided not to inform data subjects. The register can be a standalone document or part of the record of processing activities, provided the breach information is clearly identifiable and can be extracted on request.
A good register entry states: time of discovery and hour zero, description and type of breach, data and people involved, reasoned risk assessment, decisions on notification and communication with dates, measures taken. Filled in during the incident, it becomes your decision trail if the authority asks questions.
Data breach and NIS2: two different notifications, not to be confused
If your company is an essential or important entity under Italian Legislative Decree 138/2024, which transposes the NIS2 Directive, you have a second notification duty, separate from the GDPR one. Article 25 of the decree requires you to notify CSIRT Italia, established within the National Cybersecurity Agency (ACN), of significant incidents, meaning those with a significant impact on the provision of your services.
GDPR (Arts. 33 and 34) | NIS2 (Legislative Decree 138/2024, Art. 25) | |
|---|---|---|
Who must comply | Every data controller | Essential and important entities |
What is notified | Personal data breach posing a risk to individuals | Significant incident affecting services |
To whom | Garante per la protezione dei dati personali | CSIRT Italia (ACN) |
Deadlines | Without undue delay, where feasible within 72 hours; information in phases | Early warning within 24 hours; notification within 72 hours; final report within one month of the notification |
People affected | Communication to data subjects if the risk is high | Communication to service recipients where appropriate, after consulting CSIRT Italia |
Same incident, two clocks
Ransomware at a company subject to NIS2 can be both a significant incident and a data breach. In that case you make two separate notifications, to two different authorities. The EDPB is clear on this: notification under NIS rules does not replace notification to the data protection authority.
Both clocks start from awareness, but of two different things: the significant incident for NIS2, the compromise of personal data for the GDPR. They may or may not coincide. The first deadline to expire is the 24-hour early warning to CSIRT Italia, which therefore sets the pace of the first hours. To learn how to set up incident management for NIS2 within a management system, read our guide on ISO 27001 and NIS2.
What are the most common mistakes?
The first mistake is waiting for the full picture: the 72 hours are for notifying what you know, not for finishing the investigation, and notification in phases exists for this. The second is not knowing who decides: without a clear mandate, a delegation and a digital signature ready, the alert bounces between IT, administration and management.
The third is forgetting suppliers. If the contract with a processor does not state how quickly and with what information it must alert you, you will discover the breach late. Reviewing the contracts of your most critical suppliers is time well spent. The fourth is not recording minor breaches, such as an email to the wrong recipient resolved with a phone call. The fifth is confusing GDPR and NIS2, making a single notification or forgetting the 24-hour early warning.
Finally, testing the procedure only during a real incident. An exercise on a scenario like the one in the timeline brings out in an hour the problems you would otherwise discover on a Friday evening, and you can integrate it into your business continuity plan.
How Complaion helps you prepare for a data breach
The first 72 hours are almost entirely decided before the incident: procedure, roles, delegations, supplier contracts, register, risk assessment criteria. On the GDPR path with Complaion you are supported by a dedicated Lead Auditor, who analyses how you process data today and helps you set up the breach management procedure: who decides, how quickly suppliers must alert you, how risk is assessed, what goes in the register. They propose the path best suited to your company's needs, including when GDPR and NIS2 have to be managed together.
The platform collects evidence, manages documents, from the procedure to the breach register, keeps the schedule of reviews and exercises and prepares audits. If you need a DPO, with the outsourced DPO service Complaion takes on the role and supports you in dealings with the Garante and with breach notifications, while responsibility remains with the controller. More than 1,000 clients already work with us. If you want to find out whether your procedure would hold up on a Friday evening like the one in the example, contact us.
Frequently asked questions about data breaches
How soon must a data breach be notified to the Garante?
Without undue delay and, where feasible, within 72 hours of the controller becoming aware of it. The 72 hours are calendar hours and include weekends and public holidays. If you notify after this deadline, you must give the reasons for the delay. Information not immediately available can be provided in phases.
When does the 72-hour count start?
From the moment you have a reasonable degree of certainty that a security incident has compromised personal data, according to the EDPB guidelines. You do not need to know the cause and extent. A short initial check is allowed, but it must start immediately. If the breach occurs at a supplier, you generally become aware when they inform you.
Do all data breaches have to be notified?
No. Notification to the Garante is not required if the breach is unlikely to result in a risk to the rights and freedoms of individuals. Every breach, however, must be documented in the internal register with the reasoning behind the decision. When in doubt, notifying is the more prudent choice.
What if I do not have all the information within 72 hours?
You submit a preliminary notification with what you know and complete it with one or more supplementary notifications, as provided by Article 33(4). The number of people and records can be approximate. It is advisable to state straight away that updates will follow.
When do I have to inform clients, employees or users?
When the breach is likely to result in a high risk to their rights and freedoms, for example identity theft, fraud or disclosure of health data. Communication must be made without undue delay, in plain language and with practical advice. It is not required if the data was adequately encrypted or if you have already eliminated the high risk.
Does a supplier that suffers the breach have to notify the Garante?
As a rule, no: the processor must inform the controller without undue delay, and it is the controller that assesses and notifies. The supplier can notify on the controller's behalf only if the contract provides for it, and responsibility still remains with the controller. This is why notice times and content must be set in the contract.
If I am a NIS2 entity, does notifying CSIRT Italia also cover the GDPR?
No. They are two distinct obligations, with different authorities, criteria and deadlines. For a significant incident you send CSIRT Italia an early warning within 24 hours, a notification within 72 hours and a final report within one month. If personal data is involved, you also make a separate notification to the Garante under Article 33 of the GDPR.
