In brief. A data breach must be notified to the Italian Data Protection Authority (Garante) “without undue delay and, where feasible, not later than 72 hours” (Article 33 GDPR) after the controller has become aware of it, that is, once it is reasonably certain that the breach has occurred. These are calendar hours, public holidays included. Notification is not required only where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The breach must be communicated to the data subjects when it is likely to result in a high risk (Article 34, which provides for three exhaustive exemptions). Every breach, including those not notified, must be documented in the internal register (Article 33(5)). Failure to comply with these obligations exposes the controller to fines of up to 10 million euros or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
When people talk about a personal data breach, they immediately think of a hacker attack. The reality is broader and often closer to home: an email forwarded to the wrong recipient, a lost device, improper access by someone working inside the organisation are, equally, a data breach. From that moment the controller — a business, a professional, a public body or an association — has little time: seventy-two hours to take decisions that Regulation (EU) 2016/679 (GDPR) governs in detail. This guide explains what counts as a breach, when and how to notify it to the Garante, in which cases the data subjects must be informed, how to organise the first hours and what is at stake for those who do nothing.
What a personal data breach is
Article 4(12) of the Regulation defines a personal data breach as a breach of security leading — accidentally or unlawfully — to the destruction, loss, alteration, unauthorised disclosure of, or access to, the personal data processed. Three aspects may be affected: confidentiality (unauthorised disclosure or access), integrity (alteration of the data) and availability (loss or destruction, even if only temporary).
The notion therefore covers very different events: a ransomware attack that encrypts the archives and makes them inaccessible; the loss of an unencrypted laptop; a message sent with the list of recipients in plain view; the theft of credentials; even an employee who consults company databases for purposes unrelated to their duties. It does not matter whether the event is intentional or merely negligent: what matters is the effect produced on the data.
Notifying the Garante: the 72-hour deadline
When a breach occurs, Article 33 requires the controller to notify it to the supervisory authority — in Italy, the Garante per la protezione dei dati personali — “without undue delay and, where feasible, not later than 72 hours” after having become aware of it.
The obligation has a single exception: notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This assessment must be carried out rigorously and put in writing: the exemption presupposes a reasoned judgment, not a convenient self-absolution.
The notification must have a minimum content (Article 33(3)):
- a description of the nature of the breach;
- the categories and approximate number of data subjects and of records concerned;
- the contact details of the contact point (the DPO or another point of contact);
- the likely consequences of the breach;
- the measures taken or proposed to address it and mitigate its effects.
If this information is not immediately available, notification in phases is allowed: first a preliminary notification, then a supplementary one. If, on the other hand, the notification is made after the seventy-two hours, it must state the reasons for the delay: missing the deadline does not remove the obligation, and the delay must be justified.
The notification is submitted exclusively through the online procedure available on the Garante’s services portal (decision no. 209 of 27 May 2021, web doc. no. 9667201; servizi.gpdp.it/databreach). On the same portal the Garante provides a self-assessment tool, which helps identify the steps to take after a security incident, and a specimen of the notification form: it does not count as a notification, but it shows in advance what information will be requested.
When the 72 hours start to run
The deadline does not run from the event, but from the moment the controller becomes “aware” of it. According to Guidelines 9/2022 of the European Data Protection Board (EDPB), in version 2.0 adopted on 28 March 2023, this happens when the controller has a reasonable degree of certainty that a security incident has compromised personal data. After a first report, a short period of investigation is allowed in order to establish whether a breach has actually occurred; during that period the controller is not yet regarded as being “aware”. The investigation, however, must begin as soon as possible: a controller that fails to act in time, the Guidelines warn, may be held to have failed to notify.
If the breach occurs at a processor — for example an IT service provider — the processor must inform the controller without undue delay (Article 33(2)), without waiting until it has assessed the risk: the assessment is for the controller, as is the notification to the Garante. As a rule, the controller is regarded as being aware from the moment it receives the provider’s report. For this reason it is advisable for the contract with the processor (the data processing agreement, DPA) to set the timing and content of that report.
To notify or not? Six typical cases
EDPB Guidelines 9/2022 close with a table of examples (Annex B). Here are six of them, among the most frequent in practice.
| Scenario | Notification to the Garante | Communication to the data subjects |
|---|---|---|
| Stolen USB stick containing an encrypted backup | No, as long as the encryption is state of the art, the key is not compromised and the data can be restored quickly from another copy | No |
| Ransomware that encrypts all the data, with no backup | Yes, if consequences for individuals are likely: it is a loss of availability. With a backup and a swift restoration it may not be necessary | Yes, depending on the nature of the data and the effects of the unavailability |
| Attack on an online shop: usernames, passwords and purchase history published online | Yes | Yes: a high risk may result. It is advisable to force a password change |
| A hospital’s medical records unavailable for 30 hours after a cyber-attack | Yes | Yes |
| Promotional email with the recipients’ addresses in plain view (“To” or “Cc” field) | It may be mandatory if the recipients are numerous, if sensitive data are revealed (a psychotherapist’s mailing list) or other high-risk factors are present. It may not be needed if the addresses are few and reveal no sensitive data | Yes, depending on the amount and type of data and the severity of the possible consequences |
| A power outage lasting a few minutes at a call centre | No | No. The episode must still be recorded in the register (Article 33(5)) |
The examples are for guidance only: the assessment must always be made on the specific case. Further worked cases can be found in EDPB Guidelines 01/2021, devoted to examples of notification, which the Garante refers to on its own page on data breaches.
When the data subject must also be informed
Communication to the person to whom the data relate is distinct from notification to the Garante. Article 34 requires it when the breach is likely to result in a high risk to the rights and freedoms of the data subject: in that case the controller must inform them without undue delay, in clear and plain language, so that they can protect themselves — by changing their credentials, checking their account transactions and the like.
Communication is not required in three exhaustive cases (Article 34(3)):
- where the controller had implemented measures that render the data unintelligible to third parties, such as encryption;
- where, after the breach, it has taken measures which ensure that the high risk is no longer likely to materialise;
- where individual communication would involve disproportionate effort: in this case a public communication of equal effectiveness is made instead.
Even in these cases the Garante may still order the communication, if it finds that the conditions are met.
The duty to document every breach
There is one requirement that is too often neglected: under Article 33(5), the controller must document any personal data breach, including those that, after the risk assessment, it has decided not to notify. The documentation must set out the circumstances, the effects and the remedial action taken, so that the authority can verify compliance with the provision.
In practice this is an internal breach register, which sits alongside the record of processing activities and expresses the same principle of accountability. According to EDPB Guidelines 9/2022, it should show the causes of the event, what happened, the data involved, the consequences and the remedies adopted. Above all, the decision not to notify must not be left to a verbal understanding: it must be put in writing, with the reasons why the risk was considered unlikely. Otherwise, in the event of an inspection, the controller will be unable to demonstrate that the assessment was correct.
What to do in the first 72 hours: the timeline
Such a short deadline leaves no room for improvisation. It is advisable to have an incident-management procedure ready. The timings below are indicative — the only deadline set by law is the 72 hours — but they help the organisation not to reach it unprepared.
- Immediately: contain. Stop the event from spreading and limit its effects: revoke an access, isolate a system, recall a message. Alert whoever, within the organisation, is responsible for handling incidents.
- Within the first 24 hours: establish the facts. Reconstruct what happened, which data and how many people are involved. This is the short initial investigation that determines whether a breach has occurred.
- Within 48 hours: assess and decide. Estimate the risk to individuals: unlikely, present or high. This determines whether to notify the Garante and whether to inform the data subjects. The decision must be put in writing, with its reasons.
- Within 72 hours: notify. Submit the notification through the online procedure, even in preliminary form if some information is still missing.
- Without delay: communicate. If the risk is high, inform the data subjects with a clear message.
- In the following days: supplement and remedy. Complete the notification, update the breach register, fix the security measures that did not work.
Timeliness is no formality: every hour that passes may increase the number of people harmed and aggravates the controller’s position.
What the case law says
As regards penalties, failure to comply with the notification and communication obligations falls within the band of Article 83(4)(a) of the Regulation: up to 10 million euros or, for undertakings, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher. That this rigour is not merely theoretical is shown by three decisions of the Garante from 2026; the first, it should be said at once, has been challenged and is before the court.
By decision no. 208 of 26 March 2026 (web doc. no. 10234984) the Garante imposed on Intesa Sanpaolo S.p.A. a fine of 31.8 million euros. According to the Authority’s announcement, the case arose from a breach — notified by the bank in July 2024 — consisting in an employee’s access, without justified reason, to the banking data of 3,573 customers, with more than 6,600 consultations between February 2022 and April 2024: the accesses had therefore continued for more than two years without being detected by internal controls.
The Garante found, first, that the security measures as a whole were inadequate (Article 32): the operating model allowed staff to query the entire customer base without controls capable of preventing and detecting unjustified access. But the Authority also criticised the handling of the breach: in the press release accompanying the decision the notification is described as “incomplete and late”, and the communication to the data subjects is reported to have been made only after an earlier decision of the Garante of 2 November 2024. The decision is not final: it has been challenged before the Court of Turin (Tribunale di Torino), which by interim order of 13 July 2026 suspended its enforceability; the opposition proceedings are pending and, in the meantime, the Garante has temporarily removed the text of the decision from its website. Pending the court’s ruling, two indications can be drawn from the case: a breach may come from inside the organisation, and not only from outside; and the Authority looks not only at how the data were protected, but also at the timing and completeness of the notification and of the communication to the data subjects.
The second case concerns precisely the timing of the communication to the data subjects. By decision no. 280 of 17 April 2026 (web doc. no. 10252460) the Garante imposed on The European House - Ambrosetti S.p.A. a fine of 85,000 euros following a data exfiltration that involved 61,670 users of its online services and their login credentials; the passwords were stored in plain text or with cryptographic techniques that were not state of the art. The company had submitted a preliminary notification on 8 April 2024, but informed the data subjects only from 7 June 2024, about two months after becoming aware of the breach (4 April 2024) and after a corrective decision of the Authority. At first it had taken the view that the risk was not high and, as it later stated in the proceedings, it had also refrained from sending the communication because of the possible reputational risks. The Garante held that the communication was late and observed that “having allowed reputational reasons to prevail over the data subjects’ data protection rights is a sign of evident scant regard for the principle of accountability” (our translation).
Finally, notification is not the end of the matter. By decision no. 348 of 14 May 2026 (web doc. no. 10263796), adopted after examining two data breach notifications submitted by Wind Tre S.p.A. on 20 and 28 February 2025 — one of the breaches concerned the data of 365,048 customers —, the Garante imposed a fine of 1,715,600 euros for the inadequacy of the security measures. Notifying is a duty, but it opens the Authority’s review of how the data were protected.
The rules on data breaches reward those who prepare in good time. A response procedure, trained staff and a carefully kept breach register make it possible to face the incident with a clear head, precisely in the hours when every decision has to be taken quickly. It is the same approach that underpins the other privacy requirements — from the website privacy policy to the record of processing activities — and that lies at the heart of GDPR compliance for businesses, professionals and organisations. We provide support in the event of a data breach — risk assessment, drafting of the notification to the Garante and of the communication to the data subjects, setting up the procedure and the breach register — as part of our privacy and GDPR advice.
Frequently asked questions
Are the 72 hours business days? No: they are calendar hours and include Saturdays, Sundays and public holidays. This is why it is advisable to have a response procedure that also works outside office hours.
When do the 72 hours start to run? From the moment the controller is reasonably certain that the breach has occurred, not from the moment of the event. A short initial investigation is allowed, but it must be started immediately.
Is an email sent to the wrong recipient a data breach? Yes: it is an unauthorised disclosure. The risk must be assessed and, if it is high, the breach must also be communicated to the data subjects.
If the breach occurs at a provider, who notifies the Garante? The controller. The provider, as processor, must alert the controller without undue delay; the risk assessment and the notification remain the controller’s responsibility.
Must the data subject always be informed of a breach? No: communication to the data subject (Article 34) is required only where the breach presents a high risk; in other cases notification to the Garante, where due, is sufficient.
This article is for informational purposes and reflects the rules in force as at the date of publication; it does not replace an assessment of the specific case.
This article is for general information only and is not legal advice on any specific case. Content reviewed by Giuseppe Foti, legal consultant — last checked on September 30, 2026.