# Regulatory Standards — Vendor Breach Cascade

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 33(1)**: "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons."

- **Article 33(2)**: "The processor shall notify the controller without undue delay after becoming aware of a personal data breach." This is the trigger for the cascade — the processor's notification starts the controller's 72-hour clock.

- **Article 33(3)**: Notification content requirements: (a) nature of breach, categories and numbers; (b) DPO contact; (c) likely consequences; (d) measures taken or proposed.

- **Article 33(4)**: "Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay." This permits phased notification.

- **Article 34(1)**: "When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay."

- **Article 34(3)**: Exemptions from data subject notification where technical protection measures render data unintelligible, subsequent measures eliminate high risk, or disproportionate effort required.

- **Article 82**: Right to compensation. Establishes joint and several liability for controllers and processors involved in a breach.

### EDPB Guidelines 9/2022 on Personal Data Breach Notification

- **Paragraph 73**: "Without undue delay" for processor notification means the processor should notify the controller as soon as it has become aware of the breach, without waiting to gather complete information.
- **Paragraph 74**: The processor need not conduct a full investigation before notifying the controller — initial notification with available information is sufficient.
- **Paragraph 75**: DPA-specified timeframes (e.g., 24 hours) are compatible with and supplement the GDPR requirement.
- **Paragraph 82**: The 72-hour clock starts when the controller becomes aware — which is when the processor notification is received by the controller.

### EDPB Guidelines 01/2021 — Examples Regarding Breach Notification

Provides practical examples including:
- Ransomware attack on a processor (Example 1)
- Data exfiltration from a cloud service (Example 4)
- Employee data breach at HR service provider (Example 7)
- Multi-party breach affecting multiple controllers (Example 13)

Each example includes assessment of notification obligations, timing, and content requirements.

## Supervisory Authority Guidance

### Irish DPC — Processor Breach Notification Guidance (2022)

The DPC as lead supervisory authority for many tech companies has clarified:
- Processors must have documented breach detection and notification procedures
- "Becoming aware" means when the processor has a reasonable degree of certainty that a breach has occurred
- The controller should not rely solely on the processor's risk assessment — the controller must make its own determination

### French CNIL — Breach Notification Recommendations

CNIL recommends:
- Processors should notify controllers within 24 hours maximum
- Controllers should not wait for complete vendor investigation before assessing notification obligation
- Phased notification is preferable to delayed notification

### Spanish AEPD — Guide on Breach Management (2021)

The AEPD provides detailed guidance on coordinated breach response:
- Clear escalation paths must be documented in advance
- Tabletop exercises should include vendor breach scenarios
- Notification templates should be pre-prepared for common breach scenarios