Processor data breach: notification, agreement and joint process

A personal data breach at a processor does not wait until the controller has discovered it. Under Article 33(2) GDPR, the processor must notify the controller of a personal data breach without undue delay. Businesses therefore need a clear reporting channel, useful first facts and a coordinated investigation between the service provider and the controller.

This article focuses on the practical relationship between processor and controller. It explains which information the processor should provide first, how the agreement should support the process and how the controller prepares its own assessment, notification to the supervisory authority and, where necessary, communication to affected individuals. There is no general 24-hour legal deadline for every processor breach. The central standard is prompt action supported by a clear contractual process.

The roles must be separated at the start. A processor processes personal data on behalf of the controller and must notify the controller of a breach it has become aware of without undue delay. The controller then assesses the risk to the rights and freedoms of individuals and decides whether notification to the competent supervisory authority is required.

Article 33(1) GDPR generally refers to 72 hours from the time the controller becomes aware of the breach. This is not a general deadline for the processor. The processor must not wait until that period is nearly over. Its information must reach the controller quickly enough for the controller to assess the incident and, where required, notify the authority.

The agreement may set specific internal times, contacts and minimum information. It cannot remove the duty to notify without undue delay or transfer the controller’s risk assessment to the processor. If a notification is made after 72 hours, the reasons for the delay should be recorded. A breach that is not notified must still be documented so that the decision remains explainable.

Article 28(3)(f) GDPR requires the processor to assist the controller with compliance under Articles 32 to 36. A breach clause should therefore do more than name a general email address. It should identify the responsible team, emergency contacts, replacement contacts and the way a report is acknowledged, including outside ordinary business hours where the risk requires it.

Useful minimum information includes discovery time, type of incident, affected systems, data categories, possible groups of individuals, known or estimated numbers, cause, containment measures and open questions. If a fact is not yet known, the processor should say so and set a time for the next update.

The overview of processors and service providers supports the preliminary review of roles, sub-processors and audit rights. The processor agreement check can help identify missing contractual points. Neither replaces a review of the actual agreement and communication channels.

After receiving the report, the controller should transfer the facts into a reliable working file. Record receipt, the first timeline, affected processing activities, known data categories and whether the incident is ongoing. The processor should document containment, such as disabling an account, isolating a system or restoring a protected version.

The investigation needs clear responsibilities. The processor supplies technical facts, logs, access events, affected systems and sub-processor information. The controller leads the legal risk assessment, coordinates any notification to the supervisory authority and assesses whether affected individuals must be informed of a high risk. Both sides should work from the same timeline so that later updates do not create conflicting accounts.

Evidence preservation must not prevent remediation. Logs, images and relevant communications should be secured so that investigation remains possible while access to personal data is restricted. The processor should document changes to evidence, restorations and forensic measures and provide the controller with the information needed for the assessment.

The controller must assess whether the breach is likely to result in a risk to the rights and freedoms of individuals. The number of records is only one factor. The nature and sensitivity of the data, possible identity or financial harm, discrimination risks, duration of access and the effectiveness of encryption or other safeguards may all matter.

If there is a notifiable risk, the competent supervisory authority should generally be notified without undue delay and, where feasible, within 72 hours after the controller became aware of the breach. Missing details may be supplied in stages. The Austrian data protection authority provides a dedicated data breach reporting channel. A decision not to notify must also be reasoned and documented.

A high risk may additionally require communication to affected individuals under Article 34 GDPR. This is a separate decision and must not be confused with the processor’s report to the controller. The processor can provide technical facts, causes and remediation measures. The controller generally remains responsible for the content, recipients and timing of the communication.

Article 33(5) GDPR requires controllers to document personal data breaches. The file should therefore be closed even when no authority notification is made. It should record the facts, effects, risk assessment, decision, communications and measures taken.

Bring together the agreement, initial report, updates, root-cause analysis, technical evidence, affected processing activities and sub-processor information. Check whether the file is consistent with records of processing, technical and organisational measures and privacy information. Gaps may point to a wider remediation need.

After the acute phase, improve the process. Review reporting times, escalation levels, logging, backups and access management. The data breach documentation checklist structures the first records. The data breach initial check is a starting point, not a substitute for an individual assessment.

The report reaches the wrong place: A ticket is opened, but the data protection contact or emergency representative is not informed. The agreement should define the channel and confirmation.

The processor waits for a complete investigation: Article 33(2) does not require a finished root-cause analysis before the first report. Known facts and open points should be separated.

The 72 hours are treated as a processor deadline: The authority deadline generally relates to the controller’s awareness. That does not justify a slow processor report. The controller needs the information early enough to act.

The risk assessment is outsourced: The processor can provide technical facts and an initial view. The controller generally makes the legal decision about authority and individual notification.

Only the authority is considered: Contract partners, affected people, insurers, other processors and internal decision-makers may create further communication and evidence needs.

The file disappears after closure: Without the decision and remediation record, the business cannot later demonstrate accountability or learn from the incident.

1. Secure receipt: Record time, channel, reporting person and first facts without alteration.

2. Confirm containment: The processor describes which accounts, systems or interfaces were secured and whether access remains possible.

3. Map the processing: Clarify processing activity, data categories, groups of individuals, period and sub-processors.

4. Assess risk: The controller assesses risk and possible high risk. Missing facts receive a named owner and a due time.

5. Coordinate communication: Align authority notification, communication to individuals and internal information. An initial notification can be supplemented.

6. Close and improve: Bring together decision, evidence, root cause, remediation and any contract or technical changes.

We review the reporting channel, processor agreement, available first facts and joint documentation with you. We clarify which information is still needed for the risk assessment, how a notification can be prepared and which contractual or security improvements are appropriate. Contact us with the agreement, processor report and existing timeline.