EDPB Clarifies Personal Data Breach Notification Requirements For Non-EU Controllers

On 28 March 2023, the European Data Protection Board ("EDPB") adopted updated guidelines on the obligation for non-EU established controllers to notify supervisory authorities ("SA") following a personal data breach. Article 4(12) of the General Data Protection Regulation ("GDPR") stipulates that a personal data breach occurs when there is an "accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed".

According to Article 33(1) GDPR, data controllers must notify the SA of a personal data breach without undue delay, and where feasible, not later than 72 hours after having become aware of it. In addition to controllers being compelled to alert their national SA, in the event of a cross-border breach, this must also be brought to the attention of the SA of every EU member state where affected data subjects reside.