Markus Buchheit

Text proposed by the Commission

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Amendment

1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Notifications pursuant to this Article shall be made to the competent supervisory authority of the Member State in which the controller is established or where the personal data breach has occurred. The use of any Union-level technical reporting tools or single-entry points shall remain voluntary and shall be limited to personal data breaches with clear cross-border or Union-wide systemic relevance, without prejudice to national notification channels.