GDPR Data Breach Notification Guide for Non-EU Companies

Under GDPR Article 33, any personal data breach must be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach. For non-EU businesses without an EU Representative, this requirement poses unique challenges — because the 72-hour clock starts ticking before you may know which DPA to contact.

What Is a Personal Data Breach?

Article 4(12) defines a personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.” This includes:

• Confidentiality breaches: Unauthorised access (hacker, insider threat, lost device)
• Integrity breaches: Data altered without authorisation
• Availability breaches: Data lost, encrypted by ransomware, destroyed

The 72-Hour Rule

The clock starts when you become aware of the breach. “Becoming aware” is defined as when you have a reasonable degree of certainty that a breach occurred. The notification must include:

• Nature of the breach (categories and approximate number of data subjects and records)
• Contact details of the DPO or EU Representative
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate effects

Risk to Data Subjects — Article 34

If the breach is likely to result in a high risk to individuals’ rights and freedoms, you must also communicate the breach to the affected data subjects without undue delay. This communication must describe the nature of the breach, recommended mitigation steps, and the contact of your data protection officer or EU Representative.

Failure to Notify Consequences

Failure to notify a breach under Article 33 can result in fines up to EUR 10 million or 2% of global turnover (Article 83(4) — upper tier). Additionally, failure to communicate to data subjects under Article 34 can result in fines up to EUR 20 million or 4% of global turnover.

How EU Shield Helps

Your EU Representative provides the required contact point for breach notifications, helps determine the correct DPA (lead supervisory authority), and maintains records of all data breaches as required by Article 33(5). Get started from EUR 490/year →