A Breach With Four Clocks
Vantage Learning is a SaaS provider with 900 institutional customers in the EU, the UK, and 12 US states. On Friday at 18:00 UTC an engineer discovers that a misconfigured object storage bucket exposed 40,000 student records - names, emails, accommodation notes - for an unknown period; logs show access from three unrecognized IPs 11 days earlier. One EU customer's DPA requires notification without undue delay and within 24 hours contractually. GDPR sets 72 hours; one US state requires 30 days, another 45; the UK ICO expects 72 hours. The data sits in an EU region but is processed by a US-based subprocessor for analytics. Legal asks whether this is a personal data breach at all, since the files may never have been downloaded.
1. Is this a reportable personal data breach, and when did the clock start?
Read the worked answer
Yes, and the clock started on discovery, not at the 11-day-old log entry.
Under GDPR a personal data breach includes unauthorized access to personal data; exfiltration need not be proved. Three unrecognized IPs reading objects is access. Whether files were downloaded affects severity assessment, not reportability - and confidentiality is presumed lost until forensics shows otherwise, because you cannot prove a negative.
The operative deadline is not the 72-hour one. Vantage is a processor for its 900 institutional customers; each institution is the controller. Article 33(2) obliges the processor to notify the controller without undue delay, and the DPA tightens that to 24 hours. The 72-hour supervisory-authority clock belongs to the customers. So Vantage's first deadline is roughly Saturday 18:00 UTC under contract.
Awareness is the point of reasonable certainty that a security incident led to personal data exposure - Friday's finding, not the day the logs were written. Do not backdate it, and do not wait for a complete investigation: supplementary notifications are permitted and expected.
2. Does the US subprocessor arrangement change the analysis? Address role allocation, the CLOUD Act, and mitigation options.
Read the worked answer
Two distinct issues; do not blend them.
Role chain: Vantage is processor and the US analytics provider is a sub-processor. That requires prior authorization from the controllers (generic or specific), flow-down of equivalent obligations by contract, and disclosure in the DPA. In this incident the sub-processor's duty runs to Vantage and Vantage's runs to the customers; do not let the sub-processor's timeline become yours.
CLOUD Act exposure: a US-incorporated provider can be compelled to disclose data it holds or controls regardless of storage location, so 'the bucket is in an EU region' is not a complete answer to a customer's transfer question. It is not a breach-notification issue, but customers will raise it in the same call.
Mitigations, strongest first:
- Move analytics to an EU-incorporated entity or EU-only sub-processor.
- Customer-controlled keys held outside the provider's control, so compulsion yields ciphertext.
- Failing both, SCCs plus a transfer impact assessment with documented supplementary measures, accepted as residual risk.
What not to say in the breach call: that regional storage resolves the transfer question. It does not, and the statement becomes a supervisory finding of its own.
3. Set the notification sequence and timing across customers, regulators, and data subjects, and justify the ordering.
Read the worked answer
Sequence by legal obligation first, relationship second, regulator third - with one consistent message.
- Customers (controllers), within 24h. Facts known and unknown, categories and approximate number of data subjects (about 40,000, EU subset quantified), likely consequences, measures taken and planned, a named contact, and the next update time. They cannot meet 72 hours if you take 48.
- Preserve and scope in parallel. Snapshot access logs, establish the exposure window, enumerate every affected object. Say 'approximately 40,000, under verification' rather than a precise wrong number.
- Regulators: not Vantage's call unless the DPA delegates it. Offer drafted text so 900 customers tell a consistent story and coordinate timing so no data subject or journalist learns before the institutions do.
- Data subjects: the controller's decision. Prepare templates and a support script anyway, since institutions will ask you to execute.
- US state clocks (30 and 45 days) run against the state-level controllers. They are longer, which is why the EU/UK 72-hour and contractual 24-hour obligations drive the entire schedule.
Principle: notify on the earliest applicable clock with honest uncertainty, then supplement. A late accurate notification is a violation; an early approximate one is compliance.