A notification obligation turns a technical incident into a regulatory event, and it does so on a clock nobody controls. The period runs from the moment the company becomes aware of the breach, a notion meaning neither certainty nor understanding: a reasonable degree of confidence that a data breach has occurred is enough. Yet that moment almost always arrives long before the investigation can say which data left and for how many people. It is that asymmetry, between a short clock and slow knowledge, that makes the whole difficulty of the subject. This module reasons on the GDPR and its seventy-two hour period, but other regimes are added depending on the entity, each with its own clock: NIS2 for essential and important entities, with an early warning within twenty-four hours, a notification within seventy-two hours and a final report within one month, and DORA for the financial sector.
A frequent confusion must first be dispelled: notifying is not confessing, and not notifying is not protecting oneself. A supervisory authority discovering an unnotified breach handles two failings instead of one, and the second is the one it sanctions most readily because it is easy to establish. Conversely, a notification made in time, even incomplete, places the company in a cooperative posture that weighs in the later assessment. The question is therefore never whether to notify but what to say and to whom, within a period that is not negotiable.
Phased notification is the mechanism practice has built to resolve the asymmetry, and one must know how to use it. The texts allow an initial notification to be followed by supplements as the investigation advances: one states what is known, names what is unknown, announces a timetable. That route is far superior to the two symmetrical errors urgency produces. Waiting for certainty means missing the deadline. Notifying broadly, assuming the worst perimeter, exposes people who were not affected and creates a civil exposure nothing required opening.
A second obligation is added, distinct and often confused with the first: informing the individuals concerned. It obeys neither the same threshold, since it presupposes a high risk to rights and freedoms, nor the same timetable, since it is done without undue delay with no hour count. Its implementation cost is considerable, addresses to find, a channel to choose, a call center to open, and that cost belongs to response costs. Confusing the two obligations leads either to informing people too early on a wrong perimeter, or to believing the second discharged because the first is.
The multi-jurisdictional dimension is the third trap and it closes on companies handling data from several countries. Thresholds, deadlines, competent authorities and sectoral regimes differ, and one breach can trigger parallel obligations before several regulators, with content that cannot contradict itself. Establishing before the incident the map of jurisdictions where data is held, and the contact point in each, is a day's work that becomes impossible in seventy-two hours.
An allocation question must finally be raised, because it decides who notifies: that of controller and processor. A provider suffering the incident notifies its customers, which notify the authorities; the deadlines then nest, and the processing contract often gives the provider a period far shorter than the regulatory one, precisely to leave its customer time to act. A provider discovering that clause during the incident also discovers it is late. It is read at signature, and it is tested, as one tests a backup.
The discipline comes to three preparations and one rule. Map the jurisdictions and competent authorities before the incident. Know who, in the company, decides to notify, and make sure that person is reachable on a Sunday. Have read the notification clauses of one's processing contracts, in both directions. And the rule: notify within the period with what is known, naming what is unknown and announcing what follows, rather than waiting for a certainty that will arrive in six weeks.
A health services operator discovers on Friday the 12th at 5 p.m. traces of unauthorized access to a database containing patient records. At this stage, the investigation cannot say which tables were read, nor how many people are concerned: the logs cover four months and analyzing them will take three to four weeks. The database contains data on patients resident in three countries. The regulatory notification period is seventy-two hours from awareness. The general counsel proposes waiting for the investigation's conclusions so as not to notify false information. What should be decided?
The general counsel's proposal is the most expensive one, and its motive is honorable, which makes it hard to set aside. Waiting for conclusions would overshoot the deadline by several weeks, and an authority discovering an unnotified breach handles two failings instead of one, the second being the easier to establish and the more readily sanctioned. The clock, moreover, has already started: awareness presupposes neither certainty nor understanding, and traces of unauthorized access to a patient record database are enough to constitute it. The period therefore expires on Monday the 15th at 5 p.m., weekend included, which immediately raises the question of who decides on a Sunday. The workable route is phased notification: state what is known, namely the discovery, the nature of the database and the time window of the logs; name what is unknown, the exact perimeter and the number of people; and announce the investigation timetable with an undertaking to supplement. Two points are added and handled separately. Informing the individuals concerned obeys neither the same threshold nor the same timetable: it presupposes a high risk and is done without undue delay, which leaves time to establish a correct perimeter rather than writing to patients who were not affected. And the presence of data in three countries opens parallel obligations whose content cannot contradict itself: the map of competent authorities must be drawn tonight, having not been drawn before.
- 01The clock starts at awareness, which presupposes neither certainty nor understanding: it runs long before the investigation says anything.
- 02Notifying is not confessing: an authority discovering an unnotified breach handles two failings, and sanctions the second more readily.
- 03Phased notification resolves the asymmetry: state what is known, name what is unknown, announce a timetable.
- 04Informing individuals is a distinct obligation, with another threshold and another timetable: confusing it with the first means writing to people not affected.
- 05The processing contract often sets a period shorter than the regulatory one: it is read at signature and tested like a backup.