What is the difference between the revised FADP and GDPR on data breach timing and sanctions?

How the two regimes differ on breach timing

Both regimes expect organisations to move quickly once a personal data breach is confirmed, but they express urgency differently. Under the GDPR, the clock is explicit, notification to the supervisory authority is due within 72 hours unless the breach is unlikely to risk individuals’ rights and freedoms. The revised FADP uses a fact-specific without undue delay standard, so the timing depends on how fast the controller can assess the incident and prepare a usable report.

That difference matters in practice because the GDPR’s fixed window pushes teams to make an early notification decision with incomplete facts, while the revised FADP gives slightly more room to investigate before reporting. Neither regime rewards delay for its own sake, and both assume that incident response, legal review, and evidence preservation are already organised before the breach happens. For privacy operations, the real issue is not just speed, but whether the organisation can determine scope and likely impact quickly enough to justify the chosen timing.

For practitioners who need the source text, the GDPR breach framework is reflected in EU General Data Protection Regulation (GDPR). A practical comparator for operational controls is NIST Privacy Framework, which helps teams structure breach response, governance, and privacy risk decisions.

Why the sanction models are not the same

The sanction design is one of the sharpest differences between the two regimes. GDPR penalties are corporate and administrative, with fines imposed on the organisation itself. The revised FADP also allows fines, but its liability model is more individualised: fines can fall on the responsible natural person, and when that attribution is difficult, companies can face criminal liability. That changes how accountability is assigned after a breach and who must be prepared to explain the notification decision.

In practice, this means boards and privacy leads should not assume that legal exposure stops at the company level. The revised FADP makes the decision chain around breach handling more personal, which increases the importance of documented escalation, clear ownership, and a defensible record of who knew what and when. Under the GDPR, the organisational fine model still demands strong governance, but the revised FADP adds a stronger incentive to identify the accountable decision-maker.

For broader control context, the breach and sanction gap is easier to manage when organisations already have disciplined logging, access governance, and incident evidence retention. The CIS Controls v8 remain a useful operational reference for those supporting controls, especially around account management and audit logging.

What this means for breach response programmes

A cross-border privacy programme should not treat the revised FADP as a softer version of GDPR, it should treat it as a different accountability model with a similar urgency expectation. The safest operating approach is to build one breach workflow that can satisfy the faster, more rigid GDPR timeline and still produce a defensible without undue delay rationale under the revised FADP. That usually means predefined triage thresholds, legal sign-off paths, and a standing record of breach facts, impact assessment, and notification rationale.

Organisations that already have mature incident response tend to do best here because they can separate three decisions cleanly: whether a breach occurred, whether notification is required, and who is accountable for the final call. Where those steps are blurred, the revised FADP’s individual liability model becomes more exposed, especially if the organisation cannot show a consistent decision trail. The practical aim is to make the reporting decision fast, documented, and attributable, not merely compliant in hindsight.

Practitioner Guidance: Align your privacy incident workflow to the strictest timing requirement you face, then make the accountability record strong enough to survive both corporate and individual liability review. Do not wait to assign ownership until after the breach is understood, because the revised FADP punishes weak attribution as much as weak timing.

Related resources from NHI Mgmt Group

• What is the difference between data leakage, data breach, and data exfiltration?
• What is the difference between data leakage and a data breach?
• What is the difference between personal data and PII in a GDPR context?
• What is the difference between a cybersecurity incident and a data breach under SEC reporting rules?