GDPR Article 34: Notice Requirements, Exceptions, and Fines

GDPR Article 34 requires an organization that suffers a personal data breach to tell the affected individuals about it, without undue delay and in plain language, whenever the breach is likely to result in a high risk to their rights and freedoms.¹ It sits alongside Article 33, which handles the separate 72-hour notice to the supervisory authority, but Article 34 is the one that reaches the people whose data was actually exposed. Not every breach triggers it. The threshold is high risk, and the content, timing, and delivery of the notice all have to meet specific standards.

When the Duty to Notify Individuals Kicks In

Article 34(1) attaches the obligation to a single condition: the breach is “likely to result in a high risk to the rights and freedoms” of the people affected.¹ The regulation stops short of defining “high risk” with a score or a checklist, so controllers have to weigh the situation. The European Data Protection Board points to several factors:

Sensitivity of the data. Special categories under Article 9, including health, biometric, and information about racial or ethnic origin, political opinions, or sexual orientation, raise the stakes automatically.²
How easily the exposed data can be linked back to specific individuals.
Severity of the likely consequences, such as identity theft, financial fraud, discrimination, or reputational harm.
Whether the affected people include children or other vulnerable groups.
The volume of records involved.

EDPB guidance treats these factors as a combined assessment rather than a checklist.³ Plain-text passwords and biometric data get special attention because affected individuals cannot swap them out the way they can cancel a card. Whichever way the conclusion goes, document it. A thin or missing risk assessment is one of the fastest ways to draw scrutiny during a regulator’s review.

One boundary worth naming: a breach that requires reporting to the supervisory authority under Article 33 does not automatically require notifying individuals under Article 34. Article 33 covers any risk that is more than negligible; Article 34 only kicks in at the higher threshold. Assuming the two obligations move together is a common mistake.

What the Notice Has to Say

Article 34(2) requires clear, plain language and mandates the content described in Article 33(3)(b), (c), and (d). In practice, the notification has to cover four things:

The nature of the breach, including the type of data involved and, broadly, how it happened.
A contact point where the recipient can get more information, typically the Data Protection Officer.⁴
The likely consequences, described realistically. Unauthorized account access, identity fraud, exposure of sensitive information.
The steps the organization has taken or plans to take, plus what the individual should do on their own, such as changing passwords or monitoring financial accounts.

The “clear and plain language” requirement is not decorative. Regulators have criticized notices that hide behind legalistic phrasing. Give the reader enough to understand the scope of their exposure without burying them in forensic detail.

How Fast, and How to Deliver It

Article 34(1) sets the timing as “without undue delay.”¹ There is no fixed 72-hour clock here; that deadline belongs to Article 33. Recital 86 recognizes that preventing immediate harm should push notice out quickly, while more complex situations calling for additional protective measures may justify a bit more time.³ Delay to manage a public-relations rollout is not what the phrase permits.

The default delivery is direct: email, postal mail, or a secure message reaching each affected person individually. Public communication, such as a prominent website banner or a media announcement, is only permitted when direct contact would involve disproportionate effort, and even then the alternative has to be equally effective at actually reaching the affected people.¹ A small note in a website footer would not clear that bar.

Three Situations Where Notification Is Not Required

Article 34(3) lists three exemptions. Each has to be documented, not just asserted.

The data was already protected by technical measures that made it unreadable to anyone without authorized access. Strong encryption qualifies only if the keys were not also compromised.¹
The controller took follow-up action that eliminated the high risk. Remotely wiping a lost device before any data was accessed is the standard example. Server logs or similar evidence should back up the claim.
Individual contact would take disproportionate effort. In that case, an equally effective public communication substitutes.

Regulators treat undocumented exemption claims with skepticism. The exemption is for genuinely low-risk situations, not a shortcut. Weak encryption or keys stored alongside the data will not satisfy the first exemption; an unverifiable claim of quick containment will not satisfy the second.

When the Regulator Can Override Your Decision

If a controller decides not to notify individuals and the supervisory authority disagrees, Article 34(4) lets the authority evaluate the breach and order the controller to notify anyway.¹ The authority can also go the other way and confirm that one of the exemptions applies.

The backstop matters because it removes the controller’s power to decide alone that nobody needs to know. Authorities often learn of a breach through the Article 33 filing and then review the Article 34 decision. A controller that skipped individual notice without documentation to justify it is in a bad position when that review starts.

Fines and Individual Compensation

Article 34 violations sit in the lower fine tier under Article 83(4): up to €10 million or 2 percent of the organization’s total worldwide annual revenue from the preceding year, whichever is higher.⁵ The higher tier of up to €20 million or 4 percent applies to different articles, not to breach-notification failures. The actual amount depends on factors like severity, whether the controller acted intentionally or negligently, mitigation efforts, and compliance history. Enforcement actions citing Article 34 have appeared across EU member states, often paired with Article 33 violations.

Fines are not the only exposure. Article 82 gives individuals who suffer material or non-material damage from a GDPR violation a direct right to compensation from the controller or processor.⁶ Material damage covers financial losses like fraudulent charges or identity-recovery costs. Non-material damage covers distress, anxiety, and reputational harm. A late or missing Article 34 notice can worsen that damage, because people who do not know their data was exposed cannot take protective steps. Controllers and processors escape liability only by proving they were not in any way responsible for the harm, which becomes a difficult argument once a notification failure is part of the record.

1
General Data Protection Regulation. GDPR Article 34 – Communication of a Personal Data Breach to the Data Subject
2
General Data Protection Regulation. GDPR Article 9 – Processing of Special Categories of Personal Data
3
European Data Protection Board. Guidelines 9/2022 on Personal Data Breach Notification Under GDPR
4
General Data Protection Regulation. GDPR Article 33 – Notification of a Personal Data Breach to the Supervisory Authority
5
General Data Protection Regulation. GDPR Article 83 – General Conditions for Imposing Administrative Fines
6
General Data Protection Regulation. GDPR Article 82 – Right to Compensation and Liability