# GDPR Art.33

URL: /systems/trust-and-governance/criteria/gdpr/art-33 · Id: `criterion:gdpr:Art.33`

> A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible.

A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible.

| Property | Value |
| --- | --- |
| Framework | GDPR |
| Reference | `Art.33` |
| Satisfied by | [Breach notification](/systems/trust-and-governance/controls/breach-notification) |