The 72-Hour Clock vs. the Forensic Investigation
You are the CISO of a mid-sized EU-based SaaS provider. On Friday at 16:00, your security team detects anomalous outbound traffic from a production database server. Initial triage shows that an attacker exploited an unpatched vulnerability in a web-facing API and exfiltrated a 2 GB compressed file. The file appears to contain a mix of anonymized analytics data (no personal data) and a table of customer contact records (names, emails, hashed passwords) for approximately 12,000 users, 800 of whom are in Germany. Your forensic team estimates it will take at least 48 hours to confirm the exact scope and whether the hashed passwords are crackable. Your legal team is on standby. The incident response plan requires notifying the supervisory authority within 72 hours of becoming aware. It is now Friday 18:00.
1. What are your immediate notification obligations under GDPR, and how do you decide whether to notify now or wait for the forensic results?
Read the worked answer
Under GDPR Art. 33, you must notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in a risk to data subjects. Awareness starts when you have a reasonable degree of certainty that a security incident has occurred that led to personal data being compromised. Here, you have confirmed exfiltration of a file containing customer contact records and hashed passwords. That is personal data, and the breach is likely to result in a risk (identity theft, credential stuffing). Therefore, the 72-hour clock started at 16:00 Friday. You cannot wait 48 hours for full forensics. You must notify by Monday 16:00 at the latest. You can submit an initial notification with the information you have, stating that the investigation is ongoing and that you will provide further details in phases (Art. 33(4)). Waiting for perfect information is a violation. You should also consider whether the 800 German users trigger additional obligations under German law (e.g., notification to the Bundesnetzagentur if telecoms, but not applicable here). Document your decision-making process. If you later determine the risk is lower, you can update the notification, but you cannot un-notify. The key is to notify within 72 hours with the information available, mark it as preliminary, and supplement later.
2. What factors determine whether you must also notify the affected data subjects, and what would you do about the 800 German users specifically?
Read the worked answer
Under GDPR Art. 34, you must notify data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms. High risk is assessed based on the nature of the data (hashed passwords can be cracked, contact data can be used for phishing), the volume, and the likelihood of harm. Here, 12,000 users had names, emails, and hashed passwords exfiltrated. The passwords are hashed, but if the hashing algorithm is weak (e.g., MD5, SHA1) or unsalted, the risk of credential compromise is high. You need to determine the hashing method quickly. If strong (bcrypt, Argon2), the risk may be lower, but phishing risk remains. For the 800 German users, German supervisory authorities (e.g., BfDI for federal, or state DPAs) may have specific expectations. You should notify all affected users if high risk is likely. Even if not strictly required, notification may be advisable for transparency. You must also consider ePrivacy rules for email notification. Coordinate with legal to craft a clear notification that describes the breach, likely consequences, and measures taken. Do not delay notification while waiting for forensics if high risk is apparent; you can notify with preliminary information and update later. Document your risk assessment.