GDPR 72-hour breach notification calculator and decision helper

Enter when your university became aware of a personal data breach and get the GDPR Article 33 deadline with a live countdown, the NIS2 deadlines if they apply, and the vendor's notice period from your DPA. Then work through a short screening based on the EDPB guidelines, open your supervisory authority's reporting page and copy an Article 33(5) log entry. Everything runs in your browser.

Published 9 October 2026 · Sources checked 9 October 2026

Also available in: Svenska · Nederlands · Norsk · Suomi · Dansk · Français · Español · Português

How is the 72-hour deadline calculated?

The 72 hours in Article 33(1) GDPR run from the moment the university became aware of the breach, and they are calendar hours: nights, weekends and public holidays all count. The EDPB's breach notification guidelines refer to Regulation 1182/71 on time limits, which includes Saturdays, Sundays and holidays in every period unless it is expressed in working days.

Article 33(1) asks for notification "without undue delay and, where feasible, not later than 72 hours" after awareness. The 72 hours are an outer limit, not a target. A notification made later must give the reasons for the delay, and if facts are missing you can notify in phases (Art. 33(4)).

The clock starts at awareness, not at the incident itself. The EDPB treats a controller as aware when it has "a reasonable degree of certainty" that a security incident has compromised personal data (Guidelines 9/2022, para. 31). A short investigation is allowed before that point, but it should start as soon as possible (para. 34).

What Regulation 1182/71 adds

In paragraph 40 of Guidelines 9/2022, the EDPB adds a footnote to the 72 hours that points to Regulation (EEC, Euratom) No 1182/71, the EU's general rules on periods, dates and time limits. Three of its rules matter here:

• Periods "shall include public holidays, Sundays and Saturdays" unless these are expressly excepted or the period is expressed in working days (Art. 3(3)).
• The extension to the next working day when a period ends on a weekend or holiday applies only to periods "expressed otherwise than in hours" (Art. 3(4)). It does not extend the 72 hours.
• For a period in hours, the hour in which the event occurs is not counted (Art. 3(1)). Read strictly, awareness at 10:20 starts the period at 11:00, so it ends at 11:00 three days later.

Validemic's analysis The tool shows the plain 72 hours from the minute of awareness as the deadline, and the strict reading under Article 3(1) as a note. Plan for the earlier time. The extra minutes are not worth an argument with your authority, and the duty is "without undue delay" in any case.

Time zones and clock changes

The tool converts the time you enter into an exact moment, so the deadline is right in any time zone. If the clocks change within the 72 hours, it counts 72 elapsed hours, which means the deadline is one hour earlier or later on the wall clock than the time of awareness. It tells you when this happens and which time is earlier.

When does the clock start if the breach is at a vendor?

In principle, when the vendor tells you. A processor must notify the controller "without undue delay" after becoming aware of a breach (Art. 33(2)), and the EDPB says the controller should in principle be considered aware once the processor has informed it (Guidelines 9/2022, para. 44). The GDPR sets no number of hours for the vendor.

The EDPB therefore recommends that processors notify promptly and add details in phases, and that the contract specifies how Article 33(2) is met, which "can include requirements for early notification" (paras. 45 and 46). The processor does not need to assess the risk before telling you: that is the university's job (para. 44). The contract must also oblige the processor to assist the university with Articles 32 to 36 (Art. 28(3)(f)).

Validemic's analysis If a DPA gives the vendor 72 hours or more, the vendor can use up the whole period before the university knows. Your own clock starts later, but your authority will still ask why the notification took as long as it did. Enter the DPA's notice period in step 1 to see whether the vendor kept to it, and record the answer. Our breach response guide lists what a DPA breach clause should contain, and the DPA checker maps an agreement against Article 28(3).

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Do I need to report a data breach?

There are three possible outcomes. If the breach is unlikely to result in a risk to people, you record it but do not report it. If it is likely to result in a risk, you notify the supervisory authority. If it is likely to result in a high risk, you also tell the people affected (Art. 34), unless an Article 34(3) condition applies. Every breach is recorded under Article 33(5).

The decision helper in step 2 follows the factors the EDPB lists in section IV of Guidelines 9/2022: the type of breach; the nature, sensitivity and volume of the data; how easily people can be identified; how severe and how lasting the consequences could be; special characteristics of the people, such as children; and the number of people affected. Several points from the guidelines drive its result:

• Where special category or criminal offence data is involved, damage "should be considered likely to occur" (para. 102).
• Properly encrypted data with an uncompromised key is in principle unintelligible, so a confidentiality breach may not need to be notified, provided a backup exists. Without adequate backups, communication to individuals can still be required (paras. 76 to 79).
• A trusted recipient, such as another department or a known supplier that returns or deletes the data, can remove the likelihood of risk (para. 114).
• When you do not know whether data was copied, assess "the worse scenario" (Guidelines 01/2021, para. 30).
• "If in doubt, the controller should err on the side of caution and notify" (Guidelines 9/2022, para. 119).

The EDPB's worked examples in Guidelines 01/2021 show how the factors combine:

Article 34(3) removes the duty to tell individuals if the data was unintelligible (for example encrypted), if later measures mean the high risk is no longer likely, or if individual contact would involve disproportionate effort. In the last case a public communication is required instead. Our breach response guide applies these factors to four university scenarios.

What are the NIS2 24-hour, 72-hour and one-month deadlines?

If your university is an essential or important entity under national NIS2 law, a significant incident needs an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the incident notification (Directive (EU) 2022/2555, Art. 23(4)). These go to the CSIRT or competent authority, not the data protection authority.

An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable damage to others (Art. 23(3)). If the incident is still ongoing when the final report is due, a progress report is due then and the final report within one month of handling the incident (Art. 23(4)(e)). One ransomware attack can trigger both regimes, and the two clocks can start at different times: the NIS2 clock when you know about a significant incident, the GDPR clock when you know personal data is affected.

National laws add detail. Sweden's National Cyber Security Centre, which receives reports under the Cybersecurity Act through its Cyberportal, counts the 24 hours from when the entity identified the incident as reportable. Germany's BSI explains awareness as the moment an employee learns of the incident "(innerhalb der Arbeitszeit)", that is, during working hours. Whether a university is covered at all differs by country; see NIS2 and universities: are you in scope? and our planned NIS2 law page.

How do universities organise breach reporting?

Universities that meet the 72 hours reliably make the first step easy: one address or form, reported immediately, without waiting for all the facts. Four examples:

• Trinity College Dublin asks staff to report all breaches or suspected incidents to its data protection office "without delay for assessment", and states that "a data protection breach is not a disciplinary issue".
• The University of Edinburgh asks staff to report an incident "immediately" by email to the Data Protection Officer, and to complete part A of its breach response evaluation form within 24 hours of discovery.
• The University of Oslo asks anyone processing personal data on its behalf to tell their line manager at once, who then reports to UiO-CERT through a form; not all facts need to be known first.
• Utrecht University asks staff and students to report suspected data breaches to its ICT Service Desk as soon as possible, by a dedicated email address or by phone for urgent situations.

Validemic's analysis The common thread is that reporting is cheap for the person who notices, and the assessment happens centrally. A reporting route that is open outside office hours matters, because the 72 hours do not pause at weekends.

Is the 72-hour deadline changing?

Pending: the Commission's Digital Omnibus proposal (COM(2025) 837, procedure 2025/0360(COD), 19 November 2025) would extend the GDPR authority notification deadline to 96 hours, focus it on higher-risk breaches and create a single entry point for incident reports under several laws. On 9 October 2026 the European Parliament's Legislative Observatory lists it as "Awaiting committee decision". Until it is adopted and applies, plan for 72 hours. Article 33 is explained on our planned GDPR law page.

Sources

All sources retrieved 9 October 2026.

1. Regulation (EU) 2016/679 (GDPR), Articles 4(12), 28(3)(f), 33 and 34, EUR-Lex: eur-lex.europa.eu/eli/reg/2016/679/oj/eng (Official Journal text read via the EU Publications Office)
2. Directive (EU) 2022/2555 (NIS2), Article 23 and Recital 102, EUR-Lex: eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
3. EDPB, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0, adopted 28 March 2023: edpb.europa.eu, Guidelines 9/2022
4. EDPB, Guidelines 01/2021 on examples regarding personal data breach notification, version 2.0, adopted 14 December 2021: edpb.europa.eu, Guidelines 01/2021
5. Regulation (EEC, Euratom) No 1182/71 determining the rules applicable to periods, dates and time limits, Articles 1 and 3: EUR-Lex, CELEX 31971R1182 (original text read via legislation.gov.uk, as adopted by the EU)
6. European Parliament Legislative Observatory, procedure 2025/0360(COD), Digital Omnibus: oeil.europarl.europa.eu
7. Supervisory authorities' breach reporting pages: IMY, Datatilsynet (Denmark), Tietosuojavaltuutetun toimisto, Autoriteit Persoonsgegevens, CNIL, AEPD, CNPD, APD/GBA, Data Protection Commission, ICO and the Datenschutzkonferenz list of German supervisory authorities. We could not reach datatilsynet.no on the check date.
8. NIS2 reporting points: Sweden, Nationellt cybersäkerhetscenter; Denmark, Styrelsen for Samfundssikkerhed; Finland, NCSC-FI at Traficom; Netherlands, NCSC; Germany, BSI: NIS-2-Meldepflicht; Ireland, NCSC incident reporting; European Commission, NIS2 transposition
9. Trinity College Dublin, Data Breach Notification: tcd.ie/dataprotection/databreach
10. The University of Edinburgh, Data protection breach and complaints procedure: data-protection.ed.ac.uk/breach-procedure
11. University of Oslo, Avvik ved behandling av personopplysninger: uio.no, personvern, avvik
12. Utrecht University, Report data breach: uu.nl, report data breach

About this page

Sources checked on 9 October 2026. We read the GDPR and NIS2 in the Official Journal versions published by the EU Publications Office, both EDPB guidelines in full, Article 3 of Regulation 1182/71, each authority and university page linked above, and the European Parliament's procedure file. The decision helper is our own simplification of the EDPB factors and examples. It is a screening aid and not legal advice; the controller and its DPO remain responsible for the assessment, and national law or your authority's practice may add requirements. The date logic was tested across daylight saving changes. If a link has moved or you spot an error, please contact us and we will correct it.