GDPR Article 34 is the rule that requires a controller to communicate a personal data breach to affected individuals when the breach is likely to result in a high risk to their rights and freedoms. It is about direct notice to people, not just reporting to a regulator.
This matters because fast, clear communication can reduce harm from identity theft, phishing, account takeover, fraud, or exposure of sensitive data. In practice, security and privacy teams must decide whether the risk threshold is met, what facts are confirmed, and what message can be sent without guessing. Good incident response includes logs, timestamps, and documented reasoning so the organization can show why it did or did not notify. Defenders also use Article 34 planning to prepare templates, support channels, password resets, and advice that helps affected users protect themselves after a breach.