Zansa › Answers › Privacy, security and ownership
How soon must a data breach be reported under GDPR and POPIA?
Under GDPR, a controller must generally notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to risk individuals. POPIA requires notification to the regulator and affected people as soon as reasonably possible. This is general information, not legal advice.
Not every incident is notifiable, and the threshold depends on the risk to individuals. You should still record every breach internally.
Processors and operators are normally expected to tell the controller or responsible party promptly, so make sure your agreements state how quickly. Take legal advice quickly when an incident happens, because deadlines run from awareness. Rules differ by country and sector, so check how this applies to you with a qualified adviser.
Want this applied to your business? Zansa builds dashboards and forecasts for small and mid-sized companies worldwide. Start with a free intro call.
Book a call