vendor-breach-cascade

Vendor Breach Notification Cascade

Overview

GDPR Article 33(2) requires that a processor notify the controller "without undue delay after becoming aware of a personal data breach." This obligation creates a notification cascade: the processor must notify the controller promptly, enabling the controller to assess and notify the supervisory authority within 72 hours per Article 33(1), and to notify affected data subjects per Article 34 where there is a high risk to their rights and freedoms.

The EDPB Guidelines 9/2022 on personal data breach notification emphasize that "without undue delay" for processor-to-controller notification should be interpreted strictly — the processor should notify as soon as it has established that a breach has occurred, even if full details are not yet available. DPA-specific timeframes (e.g., 24 hours) may be contractually imposed.

At Summit Cloud Partners, the Vendor Breach Notification Cascade Protocol ensures rapid, coordinated response when a vendor reports a personal data breach.

Notification Chain

Required Notifications and Timeframes

BREACH OCCURS AT VENDOR (PROCESSOR)
         │
         ├─► T+0: Vendor detects breach
         │
         ├─► T+[DPA timeframe]: Vendor notifies Summit Cloud Partners
         │     (DPA standard: within 24 hours of becoming aware)
         │     Required content per DPA:
         │     ├─ Nature of the breach
         │     ├─ Categories and approximate number of data subjects
         │     ├─ Categories and approximate number of records
         │     ├─ DPO/contact point name and details
         │     ├─ Description of likely consequences
         │     └─ Measures taken or proposed
         │
         ├─► T+0 to T+72h (from controller awareness): Summit Cloud Partners
         │     assesses and decides on supervisory authority notification
         │     (Article 33(1): within 72 hours, unless unlikely to result
         │     in risk to data subjects)
         │
         ├─► If high risk to data subjects: Summit Cloud Partners notifies
         │     affected data subjects per Article 34
         │
         └─► If sub-processors involved: Vendor ensures sub-processor
               cascade notification (sub-processor → processor → controller)

Timeframe Requirements

Cascade Response Protocol

Phase 1: Initial Notification Receipt (T+0 to T+2 hours)

Upon receiving breach notification from vendor:

Severity Classification:

Phase 2: Assessment and Investigation (T+2 to T+24 hours)

Vendor Information Requests:

Phase 3: Regulatory Notification Decision (T+24 to T+48 hours)

Article 33(3) Notification Content:

Phase 4: Data Subject Notification (if required)

Article 34(1) requires notification to data subjects when the breach "is likely to result in a high risk to the rights and freedoms of natural persons."

Exemptions (Article 34(3)):

• Controller has applied encryption or other measures rendering data unintelligible
• Controller has taken subsequent measures ensuring high risk is no longer likely
• It would involve disproportionate effort (in which case, public communication required)

Notification Content:

• Nature of the breach in clear, plain language
• DPO/contact point name and details
• Likely consequences
• Measures taken and recommended actions for data subjects

Phase 5: Coordinated Response and Remediation

Liability Allocation

DPA Liability Provisions

The DPA should address breach-related liability:

GDPR Liability Framework

• Article 82(1): Any person who has suffered material or non-material damage as a result of GDPR infringement has the right to compensation from the controller or processor.
• Article 82(2): A processor is liable only where it has not complied with processor-specific GDPR obligations or has acted outside or contrary to controller instructions.
• Article 82(3): A controller or processor is exempt from liability if it can prove it is not responsible for the event giving rise to the damage.
• Article 82(4): Where multiple controllers or processors are involved, each is liable for the entirety of the damage — with contribution rights against co-liable parties.

Multi-Vendor Breach Coordination

When a breach at a sub-processor or infrastructure provider affects multiple processors and controllers:

Key Regulatory References

• GDPR Article 33(1) — Controller notification to supervisory authority within 72 hours
• GDPR Article 33(2) — Processor notification to controller "without undue delay"
• GDPR Article 33(3) — Content of supervisory authority notification
• GDPR Article 34 — Communication of breach to data subjects
• GDPR Article 82 — Right to compensation and liability
• EDPB Guidelines 9/2022 — Personal data breach notification under GDPR
• EDPB Guidelines 01/2021 — Examples regarding data breach notification