A breach at your supplier: how to chain their notice to your notification

The short answer: if the breach happens at a supplier that processes the data on your behalf, notifying the supervisory authority is still your job. The processor has to tell you “without undue delay” (GDPR Art. 33(2)), and you have 72 hours from becoming aware of the breach to notify it, unless it is unlikely to result in a risk to people (Art. 33(1)). According to the EDPB, in principle you become aware when the processor informs you (Guidelines 9/2022, paragraph 44). The GDPR sets no deadline in hours for the processor’s notice, so that number has to come from your contract. If it isn’t there, you depend on what your supplier takes “without undue delay” to mean.

This article is written from the controller’s side: what each text says, what the processing agreement must say, what to ask on the first call and how it all fits together in an example. Where the Spanish authority is concerned, the reference is the AEPD.

Who does what

The GDPR sets the split, and it doesn’t change because the breach happened outside your walls.

Two points from the EDPB are worth having clear from the start.

First, the processor does not need to assess the risk before telling you. It just needs to establish whether a breach has occurred and notify you; the assessment is yours (Guidelines 9/2022, para. 44). A supplier that holds back its notice “until it knows whether it’s serious” is using up your margin.

Second, the processor can notify on your behalf if the contract provides for it, but the legal responsibility to notify stays with you (para. 48). As the AEPD guide puts it, delegating tasks does not mean delegating responsibility.

When your 72 hours start

Article 33(1) counts the 72 hours from when the controller has “become aware” of the breach. The EDPB considers you aware when you have “a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised” (Guidelines 9/2022, para. 31). Before reaching that certainty you may carry out a short investigation, and while it lasts you are not regarded as aware. But that investigation should begin as soon as possible (para. 34).

When the breach is at the processor, the EDPB is specific: “The controller uses the processor to achieve its purposes; therefore, in principle, the controller should be considered as ‘aware’ once the processor has informed it of the breach” (para. 44). The WP250 rev.01 guidelines of the Article 29 Working Party, which the 9/2022 guidelines update, already said the same.

Three practical consequences follow:

• The clock starts when the supplier tells you, not when it detects the incident. That doesn’t protect you from a slow supplier. Paragraph 32 reminds controllers that they must be able to learn of breaches in a timely manner, and the contract is one of the measures that make that possible.
• The 72 hours include weekends and public holidays. The AEPD guide says so. A notice that arrives on Thursday afternoon expires on Sunday afternoon.
• “Without undue delay” has no number. The GDPR sets no explicit time limit for the processor (para. 45). The EDPB recommends that the processor notify promptly and provide further information in phases, and that the contract specify how Article 33(2) is to be met, including early notification requirements where needed (para. 46). The AEPD goes a step further: the deadline should be set according to the risk of the processing and should not exceed 72 hours.

A contract that gives the processor 72 hours respects that cap, but if the supplier uses them all, your own deadline starts with all the work still to do. Agree on far fewer.

What the processing agreement must say

Article 28(3) requires a written contract with minimum content. For breaches, three points matter: point (f), which requires the processor to assist you with Articles 32 to 36; point (h), which requires it to give you the information needed to demonstrate compliance and to allow audits; and point (d), which refers to the sub-processor rules in paragraphs 2 and 4.

A clause saying “the processor shall notify without undue delay” copies Article 33(2) and adds nothing. A useful clause spells out:

• A deadline in hours. Counted from when the processor becomes aware of the breach, not from when it has analysed it. Below 72 and in line with the risk of the processing, as the AEPD asks.
• Notice without waiting to assess the risk. It reproduces the EDPB’s position: the processor notifies as soon as it establishes that there is a breach.
• Minimum content of the first notice, and notices in phases. Whatever it knows at the time about the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken. That is what you will have to notify under Article 33(3). What is missing will follow “in phases without undue further delay”, as Article 33(4) says, with a date for each update.
• A channel and contacts available around the clock. An address and a phone number on the processor’s side and on yours, with deputies. If the notice reaches a mailbox on Friday that nobody reads until Monday, the clock has run all the same.
• Cooperation and evidence. Answers to your questions within an agreed time, access to whoever is running the incident, preservation of logs and evidence, and a final report with the root cause and corrective measures. Without them you can’t complete the notification or your record.
• Sub-processors. The notice obligation passes down to them with the same deadline, and the processor tells you even when the breach is at its sub-processor. Article 28(4) requires the same data protection obligations as in the main contract to be imposed on them, and leaves the initial processor fully liable to you for their performance. Article 28(2) gives you the opportunity to object to each new sub-processor.
• Who notifies. The AEPD asks for the contract to make clear who makes the notifications and communications. If you authorise the processor to notify on your behalf, write it down, along with how it informs you first.
• Several clients affected. If the breach affects several controllers, the processor has to report the details to each of them (Guidelines 9/2022, para. 47). A general statement without the details of your processing is no use to you.

And remember that a contract clause is not verification: test the notice channel before you need it.

What the AEPD will ask for, and where you will get it

In Spain, the notification is made through the form on the AEPD’s electronic office. Its PDF version, reserved for those not required to deal with the administration electronically, sets out the sections you will have to complete. Read with a supplier breach in mind, much of the information is held only by the supplier.

The measures in place before the breach are a trap: the form warns that you must be able to prove the ones you tick if the authority asks. If you tick encryption or periodic audits on the supplier’s systems, you need its evidence.

The first call with the supplier

With the table above, the first call almost prepares itself. Take the questions in writing and note the time of each answer:

1. What happened, when did it start, and when and how did you detect it?
2. Which of our processing operations, systems and environments are affected? Are copies or test data involved?
3. Is it a loss of confidentiality, availability or integrity? Were the data encrypted, and is the key also compromised?
4. Which categories of data and people, and how many records, even roughly?
5. Is it contained? What have you done and what will you do?
6. Is a sub-processor involved?
7. Is there any sign the data are being used: extortion, publication, phishing campaigns?
8. Have you informed any authority or the police?
9. Who is our contact and when is the next update?

On the second question, the EDPB notes that you may still hold a copy of the data the processor has lost, and that may change whether you need to notify (para. 44).

Notifying without all the information

When the incident is at someone else’s premises, you may well not have everything at the 72-hour mark. The GDPR allows for this: the information “may be provided in phases without undue further delay” (Art. 33(4)). The EDPB recommends saying in the first notification that you don’t yet have all the information and will provide more later (Guidelines 9/2022, para. 57).

The AEPD sets this out in its guide and its form. You make an initial notification within the 72 hours, with whatever preliminary information or estimates you have. You then complete it with an amendment, including your decision on communicating with data subjects, within a maximum of 30 working days of the initial one. If you add nothing in that time, the AEPD will treat the initial notification as complete.

If you still notify after 72 hours, you must give reasons for the delay (Art. 33(1)).

Data subjects

If the breach is likely to result in a high risk to people, you must communicate it to them without undue delay, in clear and plain language and with at least the contact point, the likely consequences and the measures (Art. 34(1) and 34(2)). This isn’t required if the data were unintelligible, for example encrypted, or if your subsequent measures make the high risk unlikely; if it would involve disproportionate effort, an equally effective public communication is enough (Art. 34(3)). The communication is yours, even if the supplier helps: it knows the incident, you know the people.

Document all of them, including those you don’t notify

Article 33(5) requires you to document every breach, with the facts, its effects and the remedial action taken, including those you decide not to notify. The AEPD guide also asks you to keep your decisions on notification and communication, and the form asks whether you have updated your incident record. For a supplier breach, the file should hold the time of its notice, which sets your deadline, and the time of every update.

If DORA or NIS also applies to you

A breach at a supplier is often an incident under other regimes too, and each has its own clock.

DORA. If you are a financial entity and the supplier is your ICT provider, you report the major incident to the supervisor yourself (Art. 19(1)): within four hours of classifying it as major and no later than 24 hours after becoming aware of the incident (Delegated Regulation 2025/301, Art. 5). That deadline can expire well before the GDPR’s 72 hours. Every contract with an ICT provider must include its assistance with incidents related to its service, at no additional cost or at a cost determined ex ante (Art. 30(2)(f)). More detail in when an incident is major under DORA.

NIS2 and NIS. NIS2 requires essential and important entities to send an early warning within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident (Art. 23(4)). In Spain, Royal Decree-Law 12/2018 is still in force, and its notifications also cover incidents in the systems of external providers (Art. 19(3)). The state of transposition is covered in NIS2 in Spain.

None of these notifications replaces the GDPR one. The EDPB says so expressly for the NIS Directive: if the incident is also a personal data breach, it must be notified to the data protection authority separately (Guidelines 9/2022, para. 136).

An example with ACME

A made-up example to show how the deadlines chain together. The events and times are fictional.

ACME outsources its payroll to Lumen Nóminas, which processes its staff’s data as a processor. The contract requires Lumen to give notice within 24 hours of becoming aware of a breach, through a channel available around the clock, and to complete the information in phases.

Lumen gave notice five and a half hours after confirming the breach, without waiting to know whether it was serious, and ACME notified on Friday with time to spare. Under a contract that only said “without undue delay”, Lumen could have waited for Monday’s analysis: staff would have gone days without knowing their bank details were out there, and that notice would hardly have been “without undue delay”.

What isn’t true

• “If the breach is the supplier’s, the supplier notifies.” You notify. It can only do so on your behalf if the contract authorises it, and the responsibility stays with you.
• “The supplier has 72 hours to tell me.” The GDPR gives it no deadline in hours. Your contract sets the number, and the AEPD asks that it not exceed 72.
• “If I don’t have all the details, better to wait.” Notify in phases (Art. 33(4)).
• “If I don’t notify it, I don’t need to keep anything.” Every breach is documented (Art. 33(5)).

How to be ready

A reviewed breach clause in every processing agreement, a notice channel tested with your critical suppliers, the script for the first call, a file template with the fields of the AEPD form and, if DORA or NIS2 also applies to you, a table with every deadline, because the first one to expire won’t be the GDPR’s.

With Almenara, the Incidents module classifies every incident, keeps the GDPR, DORA, NIS2 and ENS reporting deadlines in view and has the reports prepared from what is already recorded for your lead to send. And in Third-party risk, a supplier can report a breach from its portal and the notice reaches all its customers on the platform.

Frequently asked questions

What if the supplier is a controller, not a processor?

Then it processes the data for its own purposes, the breach is its own and it notifies it. This article covers the case where it processes data on your behalf. If you are joint controllers, the EDPB recommends that your arrangement say who takes the lead on breach notification (Guidelines 9/2022, para. 42).

What do I do if the supplier tells me late?

Notify as soon as you become aware and, if you can no longer meet the 72 hours, give reasons for the delay (Art. 33(1)). Record in the file when the supplier detected the incident and when it told you. If the delay was undue, it has breached Article 33(2) and probably the contract, and you take that up with it.

Do I have to name the supplier in the notification?

The AEPD form asks for the processor’s details if another organisation is involved in the breach. The EDPB adds that it may be useful to name it if it is the root cause, particularly when the incident affects other controllers using the same processor (Guidelines 9/2022, para. 54).