When is your
72-hour deadline?

Enter the exact moment your organisation became aware of a personal data breach, in the relevant timezone, and it shows the GDPR Article 33 notification deadline to the supervisory authority — the strict 72-hour point with a live countdown, plus whether that point falls on a weekend or public holiday and how Regulation 1182/71 may extend it to the next working day. It also reminds you when you separately have to notify the affected individuals under Article 34. Everything runs in your browser.

From when the controller becomes "aware" of the breach — the point at which you have a reasonable degree of certainty that a security incident has compromised personal data — NOT from when the breach happened or was first detected. (EDPB Guidelines 9/2022.) If you are a processor, your duty under Article 33(2) is to notify the controller "without undue delay"; the controller's 72-hour clock then starts when they become aware.

Calendar hours. The 72 hours run continuously and include weekends and public holidays — the GDPR speaks in hours, not business days. The only adjustment is at the end: under Regulation (EEC, Euratom) No 1182/71 (referenced by the EDPB), if the deadline expires on a Saturday, Sunday, or public holiday, it is extended to the end of the next working day. breach72 shows both the strict 72-hour point and that extended date.

Treat it with caution. The strict, safe reading is to notify within 72 continuous hours — Article 33 says "without undue delay and, where feasible, not later than 72 hours". The Regulation 1182/71 extension to the next working day is a recognised interpretation for when the deadline lands on a non-working day, but practice can vary by supervisory authority, and you must know which national public holidays apply. Use the extended date as a fallback, not a plan, and document your reasoning.

When the breach is "likely to result in a high risk to the rights and freedoms of natural persons", you must communicate it to the affected data subjects "without undue delay" — there is no fixed 72-hour figure for this. Article 34(3) lists exceptions: (a) the data was protected, e.g. strong encryption that makes it unintelligible; (b) you have taken later measures so the high risk is no longer likely; or (c) it would involve disproportionate effort, in which case you make a public communication instead. breach72 surfaces this as a decision aid, not an automated answer.

Notify the supervisory authority immediately anyway. Article 33(1) expressly allows late notification provided it is "accompanied by reasons for the delay". A late notification is far better than none. breach72 will show how long ago the deadline passed so you can document it.

It handles weekends automatically. Public holidays differ by Member State and even by region, so breach72 does not assume them — it flags that a national public holiday could extend the deadline further and that you should check your supervisory authority's calendar. The safe course is to anchor on the strict 72-hour point.

No — breach72 is an informational timer that applies published rules to a date you enter. It is not legal advice and is not affiliated with any supervisory authority or the EU. For an actual breach, involve your DPO and qualified counsel. On privacy: this is a static page; your timestamp is processed entirely in your browser, never uploaded, and nothing is logged.