Loading…
Sources: European Data Protection Board, members and European Commission, adequacy decisions, checked 2026-09-17.
Who has to be told and how long you have, from the regimes that reach Slovenia. Each row keeps the article it comes from, so it can be checked rather than believed. Whether a regime reaches a particular company is a question for someone who knows it.
Widespread infringement, or serious and irreversible disruption of critical infrastructure
Personal data breach likely to result in a risk to individuals
Death of a person
Serious incident involving a high-risk AI system
Without a fixed clock
| Who | Within | When it starts |
|---|---|---|
| Competent EEA supervisory authority | 72 hours | Personal data breach likely to result in a risk to individuals |
| Affected individuals | Without undue delay | Personal data breach likely to result in a high risk to individuals |
| Market surveillance authority of the Member State where the incident occurred | 15 days | Serious incident involving a high-risk AI system |
| Market surveillance authority of the Member State where the incident occurred | 2 days | Widespread infringement, or serious and irreversible disruption of critical infrastructure |
| Market surveillance authority of the Member State where the incident occurred | 10 days | Death of a person |
| Who | How long | When it applies | Where it says so |
|---|---|---|---|
| Competent EEA supervisory authority | 72 hours | Personal data breach likely to result in a risk to individuals | Art. 33 GDPR |
| Affected individuals | Without undue delay | Personal data breach likely to result in a high risk to individuals | Art. 34 GDPR |
| Market surveillance authority of the Member State where the incident occurred | 15 days | Serious incident involving a high-risk AI system | Art. 73(2) AI Act |
| Market surveillance authority of the Member State where the incident occurred | 2 days | Widespread infringement, or serious and irreversible disruption of critical infrastructure | Art. 73(3) AI Act |
| Market surveillance authority of the Member State where the incident occurred | 10 days | Death of a person | Art. 73(4) AI Act |
The regimes that apply here and the guides that answer what this page raises, worked out from what we have written.