Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. The deadline runs from awareness of the breach. What does that word cover, and why does the precision decide the file?
Neither certainty nor understanding: a reasonable degree of conviction that a breach occurred is enough, and that moment almost always arrives well before the investigation says what data went out
The whole difficulty lies in the asymmetry between a short clock and slow knowledge, and moving the clock's start is the most natural way to make it disappear. The three other answers each do so, and each rests on something true. Confirmation by the investigation describes what one would like to wait for and overshoots the deadline by weeks. Information from the processor is indeed the starting point for a controller in that specific case, but it does not define awareness in general. Describing the nature and the number is indeed required by the form, and that is precisely what staged notification lets you complete later: requiring them before starting confuses the content of the notification with its date.
Glossary entry →2. A director believes that not notifying protects the company. What makes that calculation a losing one?
An authority that discovers an unnotified breach handles two failures instead of one, and the second is the one it most readily sanctions because it is easy to establish
The first failure is arguable, it requires characterizing technical facts; the second is simply observed, it takes comparing one date to another. That ease of proof is what reverses the calculation, not an added threat. The answer on a criminal offense adds a severity that varies by jurisdiction and is not the engine of the reasoning. The one on forfeiture of insurance conflates two distinct notifications, to the authority and to the insurer, which share neither recipient nor deadline. The one on an extended limitation period invents a civil effect, and it is attractive because it sounds like an indirect sanction for silence.
Glossary entry →3. Urgency produces two symmetric errors. What route has practice built between them, and what does each error cost?
Staged notification: you declare what you know, name what you do not, and announce a timetable. Waiting for certainty overshoots the deadline; notifying broadly exposes people who were not affected and opens a civil exposure nothing required creating
Both errors come from the same refusal to live with partial information, and the workable route consists precisely in owning it in writing. The answer on protective notification invents a suspensive effect: declaring under reserve suspends nothing, and that is in any case what staged notification already does, without claiming to stop the clock. The one notifying at maximum scope treats the excess as free when it costs: informing unaffected people creates claims. The one seeking an extension as of right invents an entitlement, and its appeal is real since it is exactly what a lawyer would wish to obtain that day.
Glossary entry →4. A company notified the authority within the deadline and considers the obligation discharged. What remains, and why does it not follow the same rules?
Informing the individuals concerned: it requires a high risk to rights and freedoms, is done without undue delay with no hour count, and carries a considerable implementation cost falling under response costs
Two distinct obligations share the same everyday name and share neither threshold nor calendar, and conflating them produces two opposite faults: informing too early on a wrong scope, or believing the second done because the first is. The difference in calendar is in fact an advantage, since it leaves time to establish a correct scope. The answer on a press release invents a publicity obligation. The one on the one stop shop names a real mechanism, which organizes cooperation between authorities and does not replace informing individuals. The one seeing only good practice is the costliest, because it misses an obligation while believing the work finished.
Glossary entry →5. A processor hit by an incident discovers mid-crisis that it is already late, while the regulatory deadline is still running. What happened?
Its processing contract imposes a far shorter deadline than the regulatory one, precisely to leave its client time to act: the deadlines nest, and that clause is read at signature and tested like a backup
The lateness comes from a contract rather than from a statute, which is what makes it invisible to anyone watching the regulation. A processor notifies its clients, who notify the authorities, and the deadline imposed on it is short by construction. The answer running the regulatory deadline from the incident removes the notion of awareness for a class of actors, which does not exist. The one placing notification to the authority on the processor inverts the split between controller and processor, and it is the most common confusion on this subject. The one deducing a reduced deadline from the client's notification invents a cooperation mechanism.
Glossary entry →