The GDPR requires that a data breach posing a risk to individuals must be reported to the data protection authority as soon as you become aware of it. The timeframe is tight: 72 hours. If you fail to report, or report late, you are not meeting an obligation under the GDPR on that point. What that concretely means depends on the situation, and that is precisely where we as editors do not make a judgment: that is for you, your lawyer, or the supervisory authority.
What can be described is this: the GDPR gives the data protection authority the power to investigate a data breach that was not reported or was reported late, and to respond to it. What that response is and whether it follows is not predetermined and cannot be predicted. For you as a business owner, the question is therefore not so much "what is the penalty", but "what do I need to arrange so that I can assess on time whether a report is necessary".
What the reporting obligation precisely requires
The GDPR distinguishes between a report to the supervisory authority and a report to the individuals themselves. The former applies when a breach poses a risk; the latter, more stringent variant applies when there is a high risk. Both assessments must happen quickly, and the 72-hour deadline for the supervisory authority starts from when you discover the breach, not when it occurred. Anyone who hasn't yet made this distinction clear can work through it in a few questions: in five questions shows where you stand provides an immediate indication of whether a report is necessary.
The core of the problem with a late report is usually not unwillingness, but time lost to unclear processes: who should take this on, is it even a data breach within the meaning of the GDPR, and do we actually have an overview of which systems contain personal data. That last point is precisely where a record of processing activities proves its worth: without an overview of your processing, working out the scope of a breach unnecessarily eats into the 72 hours you have.
You must also be able to justify not reporting
A lesser-known point is that the GDPR also requires you to document when you decide not to report a breach, and why. The accountability obligation applies to the assessment itself, not only to reporting if it does happen. A breach that you assess as "posing no risk to individuals" and for which you record that assessment nowhere is difficult to justify afterwards if asked about it. The EDPB guidelines cover this extensively; the reference and explanation are to be found in the knowledge base by topic.
Consequences that go beyond the supervisory authority
Outside the relationship with the data protection authority, there are two other places where a missed report can become an issue. The first is the processor contract: if you process personal data for a client, it often contains its own reporting deadline, sometimes shorter than the statutory 72 hours, and that deadline then applies alongside the GDPR. The second is the individual themselves: someone whose data has been breached and who finds out on their own without you reporting it cannot regain that trust, which is separate from any legal assessment.
A data protection insurer or a contracting authority that later asks how a breach was handled will look to see whether it was assessed and, where necessary, reported on time. That is different from a fine, but it does touch on what is often the reason for getting privacy in order: being able to demonstrate that there is a process in place, not just that nothing has ever gone wrong.
Why the deadline is often the bottleneck
In practice, it is rarely the willingness to report that is lacking, but the speed at which an organization can determine what happened, which data it affects and who is involved. A system that starts the 72-hour clock as soon as a possible breach is registered prevents that time from slipping away in internal discussion. How such a system is structured and what information it is based on is described on the page about where the information comes from.
Whether a specific incident at your organization is subject to reporting obligations, which exact timeframe applies in your case and what the consequences are if a report has been missed cannot be answered in general terms. For that assessment, a lawyer or the Authority for Personal Data itself is the appropriate point of contact.
Would you first like to get a picture of where you stand, without obligations? The free quick scan and the knowledge bank provide an initial indication per subject, including the location in the official text.