Conflicting Breach Timelines at a Multi-Jurisdiction Payroll SaaS
Harbor Payroll is a 600-employee payroll SaaS provider headquartered in Ireland, with engineering in India. It processes payroll for 2.5 million employees across EU, UK, and US customers. One US healthcare customer demands a HIPAA business associate agreement; EU customers require GDPR Article 28 terms and EU data residency; UK customers require UK GDPR terms. A new US state privacy law takes effect in six months and sets a 30-day breach notification deadline. Harbor has SOC 2 Type II and ISO 27001 certifications, a part-time DPO, and one subprocessor in India providing tier-2 support. A customer contract promises notification within 24 hours of any suspected incident; the GDPR requires notification within 72 hours where required. The sales team has signed three new contracts with the same 24-hour clause. The board wants a compliance roadmap and a position on the conflicting timelines.
1. Build a regulatory obligation register for these requirements and explain how you would resolve conflicts between contractual and regulatory notification timelines.
Read the worked answer
Obligation register. Columns: jurisdiction, law or contract, obligation, data type, trigger, deadline, owner, control, evidence, and conflict flag. Map GDPR Article 28 processor terms, UK GDPR, HIPAA BAA, the new US state law, and customer contracts. Include the 24-hour contractual notice as a contract obligation separate from the 72-hour regulatory deadline.
Conflict resolution. The 24-hour clause is stricter and should drive internal detection and escalation, but it must not create a legal admission. Distinguish notice of a suspected incident to the customer from notification of a personal data breach to a regulator. Build a playbook: detect, triage, notify customer within 24 hours with known facts and caveats, and make the regulator determination within 72 hours. Legal counsel approves wording. The sales team must stop signing the 24-hour clause without legal and security review; add a fallback clause aligned to without undue delay and regulatory timelines. The judgment is to meet the strictest contractual clock operationally while preserving statutory decision rights. A 24-hour commitment for confirmed breaches is easier to meet than 24 hours for every suspicion.
2. Recommend how to govern the India subprocessor and EU data residency across engineering, support, and sales.
Read the worked answer
Subprocessor governance. The India subprocessor needs a written contract with flow-down obligations, security requirements, breach notification, audit rights, and data return or deletion. Maintain a subprocessor register and notify customers as required. Restrict support access to EU data through role-based access, pseudonymization, and just-in-time access. If EU data residency is promised, keep production data in the EU and prevent support copies from being stored in India; use screen-sharing or in-region support where feasible.
Engineering and sales. Engineering must enforce data residency by architecture and configuration, with evidence. Sales must use approved contract terms and a deal desk for exceptions. The DPO should review new processing activities and transfers. The part-time DPO needs a documented mandate and access to the board. The key judgment is that a subprocessor is not a paperwork issue: if support staff can access EU payroll data from India, the residency promise is cosmetic unless access is controlled and logged.
3. The new US state law takes effect in six months. Propose a compliance change management plan with owners and milestones.
Read the worked answer
Change management plan. Month 1: legal and compliance map the new law to existing controls; appoint an owner; assess gaps in breach detection, notification, vendor contracts, and data subject rights. Month 2: update incident response playbook and notification templates; train support and engineering; amend customer contracts where needed. Month 3: test a tabletop breach scenario with legal, security, and customer success; validate 30-day notification feasibility. Month 4: update policies and the obligation register; brief the board. Month 5: internal audit or readiness review; remediate gaps. Month 6: go-live monitoring and evidence pack.
Milestones and owners. General Counsel owns legal interpretation; CISO owns detection and response; DPO owns privacy impact and records; Sales Ops owns contract changes. Report monthly to the board risk committee. The judgment is to avoid treating the new law as a legal-only project. The 30-day deadline is operationally demanding; if Harbor cannot meet it, the board must know before the effective date and approve a remediation plan, not discover the gap after an incident.