GDPR Article 34 asks a controller to communicate a personal data breach to affected people without undue delay when the breach is likely to result in a high risk to their rights and freedoms. It is a separate decision from Article 33 notification to the supervisory authority, whose threshold is risk unless risk is unlikely and whose 72-hour reference point concerns the authority. The official GDPR text sets both rules; the EDPB’s final breach guidelines explain how to assess risk and communicate with people. This guide focuses on an actionable, accurate Article 34 decision.
A high-risk assessment is about the consequences for people, not the embarrassment of the organisation or the number of press inquiries. The controller needs to know what happened, which people were affected, what they may face and whether a protective measure has made that harm unlikely. Information can change during an incident. Record the facts available for each decision and reopen it when the investigation changes the picture. The breach-handling guide helps coordinate security, legal and communications work without assuming that every incident requires the same notice.
Recognise the personal data breach first
Article 4(12) defines a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. A misplaced file, hostile account access, altered health record or unavailable emergency service can qualify. “No data were published online” does not settle a case of lost availability or integrity. Conversely, a malicious email that failed to reach any personal data is not automatically a personal data breach. The initial investigation should identify the affected data and what happened to it.
Separate the affected operations and people. If an incident touches one internal test dataset and a live customer database, their risk assessments may differ. If some records were encrypted with secure keys and others were readable, a single global “encrypted” label is misleading. Identify who could have accessed or lost access, for how long, and whether a realistic path to harm remains. The Article 32 security guide helps examine which protective controls actually applied, rather than which ones appeared in policy.
Distinguish the Article 33 and Article 34 thresholds
The Article 33 authority notice is generally required unless a breach is unlikely to result in risk to rights and freedoms. Article 34 communication to people requires a likelihood of high risk. A breach may therefore require an authority notice but no individual communication, both, or neither after a documented assessment. A processor has a different Article 33(2) duty to inform its controller without undue delay; it does not replace the controller’s Article 34 decision. The Article 33 timing guide explains awareness and phased authority information.
Risk depends on the kind of data, ease of identification, likely misuse, number and circumstances of people affected, who obtained it, and available protections. The loss of an essential health record may create serious availability harm; do not rank all availability breaches below confidentiality breaches. A single exposed account containing sensitive details may be high risk even though few people are involved. A large list of ordinary names could also support fraud or harassment depending on its context. The special-category guide helps identify data that warrants careful analysis, but Article 9 data does not create an automatic statutory notice in every fact pattern.
Consider a payroll file sent to the wrong external recipient. If it contains salaries, bank details and national identifiers, plausible harm includes fraud and exposure of private employment information. If the recipient opened it, copied it or cannot be identified, risk may remain high. If a known recipient promptly confirms secure deletion and evidence supports that no copy was made, reassess on those facts; do not automatically assume the initial risk vanished. Another example is a stolen device protected by effective encryption, with uncompromised keys and a recoverable copy. The protection may make high risk unlikely, and it can also affect the Article 33 assessment. An encrypted device is not categorically still authority-reportable.
Do not use a fictional “three out of five factors” score as a legal trigger. A scoring method may help organise information, but it cannot override a severe single consequence or guarantee a low-risk conclusion. Record the factor, evidence, uncertainty and person responsible for reassessment. If a forensic finding reveals that credentials rather than only email addresses were exposed, revisit both authority and individual notice decisions promptly. The general breach-notification guide places this threshold analysis in the whole response.
Communicate without undue delay
Article 34 sets no universal number of hours or days. “Without undue delay” reflects the protective purpose: people may need information soon enough to avoid fraud, reset credentials or seek help. A controller should not wait for an entirely finished investigation if it already has reliable facts about a likely high risk and can offer protective advice. It should also avoid alarming people with an inaccurate statement that will immediately need correction. Explain what is known, what remains under investigation and how updates will reach them.
Build the response around actions that can happen in parallel. Security staff contain the event and determine scope; the privacy owner assesses Article 33 and Article 34; communications staff prepare plain-language contact channels; customer support learns how to answer questions. The 72-hour authority-response walkthrough can help coordinate the parallel team work. The 72-hour Article 33 reference point is not an Article 34 grace period. A message could be required earlier if it prevents imminent harm, or take longer to target where identification is genuinely difficult. Document the reason for timing, especially when people could have benefited from earlier warning. There is no universal “day two to five” schedule or automatic one-week justification rule in Article 34.
Use a channel likely to reach the people concerned and protect them from further deception. A direct message from a known service may be appropriate when reliable contact details exist. If an attacker could imitate the incident message, explain a safe way to verify it, such as navigating independently to the service’s official website. Do not include a suspicious link that asks users to enter credentials. Keep translation and accessibility needs in mind for the actual audience, without asserting that every cross-border incident has one uniform language rule.
Include the information Article 34(2) requires
The communication must describe the nature of the personal data breach in clear and plain language. It must also contain at least the information and measures referred to in Article 33(3)(b), © and (d): the DPO’s or other contact point’s details, likely consequences, and measures taken or proposed to address the breach, including mitigation where appropriate. Article 34 does not require a separate numerical count in every personal message merely because the authority notice asks for approximate totals. Tell an individual which categories of their data were involved where known, because that makes the consequences understandable.
Practical advice can make a message useful. If passwords or session tokens are affected, explain which accounts were reset and what the person should do on reused services. If account numbers are involved, explain how to contact the bank or watch for suspicious transactions. If only an address book was accessed, suggest caution about impersonation. Such advice is not an additional fifth statutory field listed by Article 34(2); it follows from clear communication of likely consequences and mitigation. Avoid telling everyone to freeze credit or change every password when the incident does not support that advice.
A good message identifies the controller and event, states a realistic time range and affected information, explains what is confirmed versus possible, states likely harms, describes containment and protective steps, and gives a monitored contact route. If facts change materially, send an update to the same people or another effective channel. Coordinate with the authority notice so that differences are explained by the time of each statement, not by two teams inventing different accounts of the event. The DPO role guide can help assign a contact where one is designated; another contact point is allowed by the text.
Apply the first exception only to protection that actually worked
Article 34(3)(a) removes the communication requirement where the controller had implemented appropriate technical and organisational protection measures and those measures were applied to the affected personal data, in particular measures rendering it unintelligible to anyone not authorised to access it, such as encryption. The words “applied to the affected data” matter. An encryption policy is not enough if the leaked export was plaintext, the attacker obtained keys, or a support tool disclosed the decrypted records.
Evaluate all plausible routes of harm. If an encrypted backup was stolen but a separate attack made the service unavailable, the availability consequences need their own assessment. If credentials were exposed, encrypting a different database does not eliminate their misuse. Keep evidence of encryption status, key custody, device state and recoverability. The exception may affect whether individual communication is needed, and the same facts can affect whether an Article 33 authority notice is required. Do not announce a categorical outcome from the word “encrypted” alone.
Assess later mitigation and disproportionate effort separately
Article 34(3)(b) addresses measures taken after the breach that ensure the high risk is no longer likely to materialise. A controller should demonstrate why the measure changes the actual risk. Disabling a leaked password or recovering a misdirected file may help; it does not automatically undo information already copied or used. Record the timing and verification of the measure. If people could still take meaningful protective action, analyse whether communication remains necessary rather than relying on optimistic containment language.
Article 34(3)© applies where direct communication would involve disproportionate effort. It requires a public communication or similar measure by which the people are informed in an equally effective manner. Large scale alone does not prove disproportionate effort when the controller has reliable email addresses. Conversely, direct contact may truly be impossible for a public dataset whose affected individuals cannot be identified without collecting more information. Explain the effort and why the alternative will reach the audience effectively. A press release that nobody concerned is likely to see may not satisfy the condition. Where known contacts can be reached but others cannot, consider a combination of direct and public measures.
Article 34(4) permits the supervisory authority to require communication after considering the likelihood of high risk, or to decide that an Article 34(3) condition has been met. The controller should be prepared to show its decision and evidence, not assume a silent authority endorsed it. Keep copies of messages, channels, delivery results, public notices and later corrections under a retention rule chosen for the case and applicable law; Article 34 does not specify a universal five-year period.
Review a realistic notification decision
Suppose a school discovers that a restricted portal exposed students’ contact information and counselling appointments for several hours. Investigators know the access log is incomplete, so they cannot yet identify every viewer. The team should assess possible stigma, harassment and safety consequences, not just the number of records. It may need to notify the authority under Article 33 and communicate to affected families under Article 34 without waiting for a complete list of visitors. It should explain uncertainty honestly, provide a secure contact point and update families if later evidence changes the scope.
Suppose instead an employee mistakenly sends a routine appointment list to a trusted colleague in the same organisation who had no authorised reason to see it. The recipient reports it immediately and deletes it; the controller verifies no onward access. That remains a personal data breach for documentation, but the authority and individual notice outcomes depend on the list’s sensitivity and residual risk. Record the evidence, not a blanket rule that all internal mistakes are exempt. The data protection impact assessment guide can help with future system design where repeated access mistakes point to a broader risky processing arrangement, though a DPIA is not a substitute for breach response.
A final check asks whether the communication lets a person understand the event and reduce harm. Has the controller named the affected service and data? Are consequences realistic rather than formulaic? Are measures already taken distinguished from promises? Can a person reach a knowledgeable contact without disclosing more sensitive information to an unverified channel? Is the notice accessible to the people it concerns? Article 34 is a high-risk protective duty, not a public-relations exercise.
Article 83(4)(a) includes Article 34 obligations in a statutory fine tier. A fine is case-specific, and breaches of Articles 32, 33 and 34 do not automatically turn every incident into an upper-tier fine. The Article 83 guide explains the structure. Earlier versions of this article used fabricated score thresholds, universal day-by-day schedules and case labels without case-specific source proof. The better record is a clear high-risk assessment tied to the official Article 34 text, effective protective communication where required, and documented reasons when an exception applies.