{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/recitals/86","url":"https://www.headlesslaw.com/gdpr/recitals/86","title":"Recital 86","family":"l1_recital_view","work_id":"gdpr","view_of":"/gdpr/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2016/679, OJ L 119, 4.5.2016","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","valid_from":"2016-05-04","valid_until":null,"content_id":"307a15a546c1bebb","versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/recitals/86/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/recitals/86/versions/2016-05-04/rev/307a15a546c1bebb","versions_url":"https://www.headlesslaw.com/gdpr/recitals/86/versions","relations_url":"https://www.headlesslaw.com/gdpr/recitals/86/relations","act_url":"https://www.headlesslaw.com/gdpr/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"gdpr","path":"/gdpr/recitals","name":"GDPR","number":"Regulation (EU) 2016/679","celex":"32016R0679","title_official":null,"document_date":null},"position":{"kind":"recital","key":"86","index":86,"articles":173,"annexes":0},"prev":{"path":"/gdpr/recitals/85","key":"85","title":"Recital 85"},"next":{"path":"/gdpr/recitals/87","key":"87","title":"Recital 87"},"act_anchor":""}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","check":{"result":"matched","checked_at":"2026-11-01","against":"EUR-Lex"},"repo_path":"spaces/gdpr/recitals.md","unit_text_sha256":"058830deb99ad15946e79eba447f7ddcb3d1a7ef0dc12515909eeb1a929f5848","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"gdpr/recitals/rec/86","kind":"recital","key":"86","heading":"","text":"The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication.","marks":[],"text_hash":"058830deb99ad15946e79eba447f7ddcb3d1a7ef0dc12515909eeb1a929f5848","revision":1,"blocks":[{"locator":"gdpr/recitals/rec/86/block/1","text_hash":"058830deb99ad15946e79eba447f7ddcb3d1a7ef0dc12515909eeb1a929f5848","revision":1}]}}