GDPR Breach Notification Deadline Calculator

Enter when you became aware of a personal data breach to see the exact 72-hour Article 33 deadline, when Article 34 individual notices apply, and what must be documented — computed in your browser.

At a glance

Under GDPR Article 33, a controller must notify its supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights. High-risk breaches also require informing affected people without undue delay. This calculator computes the exact deadline.

Your incident details stay in this browser tab

The awareness time, role and risk level you enter are processed locally to compute the deadline. Nothing is uploaded, stored, or tracked.

Your breach details

The prefilled values are an editable example (aware of breach 2026-10-15 18:00 UTC, controller, risk-level breach) — not a real incident. Replace them with your own times; the deadline is calculated as your awareness instant + exactly 72 hours, per GDPR Article 33(1).

Aware of the breach (your local time)

The moment you became aware — this starts the 72-hour clock (Recital 87 context).

Your role

Controller → supervisory authority (Art. 33(1)); processor → controller (Art. 33(2)).

Risk to people’s rights

High risk adds the Art. 34(1) duty to inform affected individuals.

Within the 72-hour window

Enter your breach details above.

Deadline (your local time)

—

Deadline (UTC)

—

Remaining / overdue

—

Your notification duties

Duty	Reference	Applies?	What it means

Role- and risk-dependent duties under the EU GDPR baseline. Member-state law can add sector-specific rules; this table is not legal advice.

Notification contents checklist (Art. 33(3))

Documentation (Art. 33(5))

Fine exposure (Art. 83(4)(a))

You May Also Need

Compliance Automation Cost Comparison Price out SOC 2 / ISO tooling quotes with your own numbers. Date Difference Calculator Measure elapsed time between two dates for your incident timeline. Timestamp Converter Convert log timestamps across time zones before starting the clock.

Why Use This GDPR Breach Notification Deadline Calculator?

Exact 72-hour deadline: the Article 33(1) supervisory-authority deadline is your awareness instant plus exactly 72 hours, shown in local time and UTC with remaining or overdue time.

Role-aware duties: choose controller or processor to see Article 33(1) versus Article 33(2) notification duties, and set the risk level to surface the Article 34(1) individual-notice duty for high-risk breaches.

Notification contents checklist: the Article 33(3) items plus the phased-notification note, ready to copy into your notification draft.

Documentation and fine exposure: Article 33(5) reminders plus the Article 83(4)(a) fine-exposure reference, with a copyable summary and downloadable text report — 100% client-side, no signup.

How to Use GDPR Breach Notification Deadline Calculator

Enter your awareness time

Pick the date and time you became aware of the personal data breach in your local timezone. This instant starts the 72-hour clock.

Choose your role and risk level

Select controller or processor, and whether the breach is unlikely to pose a risk, poses a risk, or poses a high risk to people's rights.

Read your deadlines and duties

The calculator shows the Article 33(1) deadline in local time and UTC, remaining/overdue status, and which notification and documentation duties apply.

Controller, risk-level breach (example timestamps)

The Article 33(1) deadline is the awareness instant plus exactly 72 hours: 2026-10-15 18:00 UTC + 72 h = 2026-10-18 18:00 UTC. The selected risk level is 'risk, not high', so no Article 34 individual-notice duty applies; documentation applies to every breach (Art. 33(5)).

Example incident (editable defaults) Source

Aware of breach: 2026-10-15 18:00 UTC · Role: Controller · Risk: risk to rights and freedoms

Computed deadline and duties Processed

Article 33(1) supervisory-authority deadline: 2026-10-18 18:00 UTC (72 h after awareness). Individuals: no Article 34 duty (risk, not high risk). Document the breach (Art. 33(5)). Fine exposure if the Art. 33/34 duties are infringed: up to EUR 10,000,000 or 2% of turnover (Art. 83(4)(a)).

Technical Specifications & Engine Details

Technical specifications and engine details for GDPR Breach Notification Deadline Calculator
Specification	Details
Supported Formats	FORM-PARAMETERS → ON-PAGE-RESULTS, COPYABLE-SUMMARY
Execution Mode	100% Client-Side In-Browser (client)
Browser Requirements	Modern browser with JavaScript and HTML5 date/time input support enabled.
Performance Constraints	Computes only arithmetic on your entered awareness instant plus regulation-tied duty logic; the EU GDPR baseline only (member-state additions out of scope); no legal advice, no network calls, no data storage.

Maintained by Pragyan Pahadi

100% Client-Side Privacy Guarantee

Your incident details — awareness time, role and risk level — never leave your browser. The deadline math runs client-side in memory; zero data is transmitted or stored.

Frequently Asked Questions

When does the GDPR 72-hour breach notification deadline start?

The 72 hours run from the moment the controller becomes aware of the personal data breach (Article 33(1)). Awareness — not the end of the investigation — starts the clock; impossibility of completing assessment is not treated as suspending it (Recital 87 context).

Do processors also have 72 hours to notify?

No. A processor must notify the affected controller without undue delay after becoming aware of a personal data breach (Article 33(2)); the 72-hour supervisory-authority deadline applies to the controller (Article 33(1)).

Is a notification required if the breach is unlikely to pose a risk?

No Article 33 notification is required for breaches unlikely to result in a risk to rights and freedoms — but every breach must still be documented, even when no notification is made (Article 33(5)).

What happens if you miss the 72-hour deadline?

You can still notify: a notification later than 72 hours must be accompanied by the reasons for the delay (Article 33(1)). Infringements of the Article 33/34 obligations can attract fines up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher (Article 83(4)(a)).

Methodology

The Article 33(1) deadline is the awareness time plus exactly 72 hours. Remaining time and overdue status are calculated against the clock in your browser. Other duties are shown as duties because 'without undue delay' has no fixed clock in the regulation. This page is not legal advice.

Last updated October 2026.