GDPR Data Breach Fines: Notification Failures, Security Failures, and Real Enforcement Penalties

Article 33 requires controllers to notify their lead DPA 'without undue delay and, where feasible, not later than 72 hours after having become aware' of a personal data breach. If notification occurs after 72 hours, the notification must include reasons for the delay. The 72-hour clock starts from the moment the controller 'becomes aware' — which courts and DPAs have interpreted as when there is a reasonable degree of certainty that a breach has occurred, not when an investigation definitively confirms it. DPAs are increasingly penalizing delayed notifications even where eventual disclosure was full and complete. The fine is not automatic — DPAs consider how quickly the controller notified after the 72-hour window, cooperation quality, size of organization, and whether the delay caused harm to affected individuals.

Article 34 requires controllers to communicate a breach to affected individuals 'without undue delay' when the breach is 'likely to result in a high risk to the rights and freedoms of natural persons.' High risk indicators: breach of financial data, health data, passwords, location data, children's data, or any combination that could enable identity theft, financial loss, discrimination, or physical harm. Controllers can avoid individual notification if they implement effective technical measures (encryption, pseudonymization) that render the data unintelligible to unauthorized parties — or if individual notification would require disproportionate effort (in which case a public communication is sufficient). Many organizations fail to assess Article 34 applicability rigorously — focusing on DPA notification while neglecting individual notification requirements.

Article 32 requires controllers and processors to implement 'appropriate technical and organisational measures' to ensure a level of security appropriate to the risk — considering encryption, pseudonymization, ongoing confidentiality and integrity assurance, resilience, and ability to restore data access after incidents. Common Article 32 failures that lead to breaches: storing passwords in cleartext (or weakly hashed), failing to patch known vulnerabilities, inadequate access controls, transmitting personal data over unencrypted channels, and using outdated authentication methods. When a breach occurs, DPAs investigate Article 32 compliance as a standard part of the breach investigation. A breach caused by predictable, preventable security failures attracts significantly higher fines than a breach resulting from a sophisticated, novel attack.

Under GDPR's One-Stop-Shop mechanism, organizations with EU establishment in one member state have a single lead DPA for cross-border processing. For breaches affecting individuals in multiple EU countries, the lead DPA coordinates the investigation and proposes the fine. Concerned DPAs in other member states can object — and have increasingly done so, arguing lead DPA decisions are insufficiently punitive. When objections are filed that the lead DPA refuses to accept, the matter goes to the EDPB for binding resolution. EDPB binding decisions have consistently ordered higher fines than initially proposed — with Meta, WhatsApp, and LinkedIn all subject to EDPB-increased fines. For breach cases involving multinational organizations, this process can take 2–4 years from notification to final fine decision.

Understand Your GDPR Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

What qualifies as a 'personal data breach' that triggers GDPR notification?

GDPR Article 4(12) defines a personal data breach as 'a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.' This is broader than most people expect — it covers not only hacking and ransomware but also: accidentally emailing personal data to the wrong recipient; losing an unencrypted USB drive containing personal data; deleting personal data accidentally without backup; ransomware that encrypts (but perhaps doesn't exfiltrate) personal data; temporary unavailability of personal data where availability is critical to the purpose. The key question is whether there was a 'breach of security' — not just unauthorized external access. EDPB guidelines provide detailed examples for each breach type.

When does the 72-hour notification clock start?

The 72-hour clock starts when the controller 'becomes aware' of the breach — not when an investigation definitively concludes. EDPB Guidelines 9/2022 clarify that 'awareness' means there is a reasonable degree of certainty that a breach has occurred. Initial detection of an anomaly (a server error, an unusual access pattern, a ransomware note) does not by itself constitute awareness — controllers are entitled to a reasonable period of initial investigation to determine whether a breach has occurred. However, this initial assessment window should be brief (typically 24–48 hours). Once the controller concludes that a personal data breach has likely occurred — even if the full scope is unknown — the 72-hour clock starts. Controllers can submit an initial Article 33 notification with incomplete information (if the full scope is still being assessed) and supplement it later without incurring a delayed notification penalty.

Does encryption or pseudonymization eliminate GDPR breach notification obligations?

Encryption of data at rest and in transit can eliminate the Article 34 individual notification obligation under Article 34(3)(a) — if the encryption was state-of-the-art and the keys were not compromised. However, encryption does NOT eliminate the Article 33 DPA notification obligation: if a breach occurred (even if the exfiltrated data was encrypted), the controller must still notify the DPA within 72 hours. The DPA notification must describe the technical measures in place and explain why individual notification is not required. Pseudonymization (replacing identifying information with codes) provides similar protections if it is genuinely irreversible without access to the key — but pseudonymized data remains personal data under GDPR, so Article 33 notification is still required when pseudonymized data is breached. The encryption exception to Article 34 only applies when the controller can demonstrate the data is truly unintelligible to unauthorized parties.