Is notifying of the personal data breach later than 72 hours
The controllers will not always have all of the necessary information concerning the personal data breach within 72 hours after having become aware of it. Thus, in accordance with Article 33 (4) GDPR, the controller may provide the information in phases, as soon as it will be in its possession. Notifying of the personal data breach “in phases” by the controller is permitted on condition that the notification to the supervisory authority will be accompanied by reasons of the delay.
2018-08-09
