Data breach notification (72 hours)
The GDPR obligation to report a data breach to the supervisory authority within seventy-two hours, and to affected individuals where the risk is high.
Article 33 GDPR, applicable since May 25, 2018: of all the regulation's obligations, breach notification is the one counted in hours. Where a breach is likely to give rise to a risk to the rights and freedoms of individuals, the controller must notify the competent supervisory authority, in France the CNIL, within seventy-two hours of becoming aware of it (Article 33). Where the risk is high, the controller must also inform the affected individuals without undue delay (Article 34). A deadline that short demands fast detection and response, and the first hours of an incident become a legal matter as much as a technical one. For cyber insurance, these obligations are a loss item in their own right: forensic analysis to characterize the breach, legal advice on notification duties, the cost of notification itself, and dealings with the regulator and the people affected. Companies operating in several countries face a patchwork of authorities and requirements, and notification becomes the first workstream of incident response.
Textbook case: a company discovers on a Sunday evening that a customer database has been exfiltrated. The seventy-two-hour countdown forces it to pull in forensics, lawyers and management at short notice to characterize the breach and prepare the notification to the CNIL on time.
data breach notification, GDPR breach notification, 72-hour notification
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.