← GDPR · Security
Art.33 — Notification of a breach to the supervisory authority
Requirement
In the case of a personal data breach, the controller shall notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals.
UK GDPR: Under UK GDPR, notifiable breaches go to the ICO within the same 72 hours.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| SOC 2 | CC7.4 | Incident response programme | incident-response breach-notification |
| PCI DSS 4.0.1 | 12.10 | Incident response plan for suspected compromise of account data | incident-response breach-notification |
| HIPAA | 164.308(a)(6)(ii) | Response and reporting (R) | incident-response breach-notification |
| HIPAA | 164.404-410 | Breach notification to individuals, HHS and the media | breach-notification incident-response |
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified | breach-notification incident-response |
| NDPA 2023 | s.40 | Personal data breaches: notification and breach records | breach-notification incident-response |
| SOC 2 | CC7.3 | Evaluation of security events | incident-response |
| SOC 2 | CC7.5 | Recovery from identified incidents | incident-response |