Seventy-Two Hours and an Inconclusive Forensic Report
A ransomware incident at a payroll processor has potentially exposed data on 60,000 employees of the controller. Forensics confirms encryption and confirms that data was staged for exfiltration, but cannot yet determine whether exfiltration completed. The 72-hour notification clock is running with 40 hours left. The processor is asking the controller to hold. The CEO wants to wait for certainty; the GC favors notifying the lead supervisory authority now. Employees span three countries, one of which has a separate regulator. Customer-facing communications are scheduled in 48 hours.
1. How should the privacy lead frame the notification decision for the executive group?
Read the worked answer
Reframe the question. The CEO is asking 'are we certain data left our control?'; the legal test is not certainty. Under the GDPR, notification to the supervisory authority is required unless the breach is unlikely to result in a risk to individuals - an absence of evidence of exfiltration is not evidence of absence, and 'staged for exfiltration' already establishes a plausible risk.
Present it as three separable decisions with different thresholds: (1) notify the supervisory authority - low threshold, 40 hours left, reversible harm is minimal if wrong; (2) notify individuals - higher threshold, required where there is high risk, and can follow once scope is clearer; (3) public communication - a business decision informed by the first two, not a substitute for them.
Make the asymmetry explicit: notifying and later narrowing is recoverable; missing the deadline and explaining it afterwards is not.
2. How should the lead handle the processor's request to hold?
Read the worked answer
The controller's obligation is the controller's own; it cannot be delegated to or paused by a processor. Say that plainly and in writing.
But do not treat the processor as an adversary - they hold the facts the controller needs. Convert the request to hold into a request for a documented timeline: what is known, what is not, when the next forensic milestone lands, and what the processor will commit to in writing for the notification. A written processor statement supporting the controller's assessment is materially useful to the regulator.
Meanwhile, confirm the contractual position: notification obligations, cooperation duties, and indemnity under the data processing agreement. If the processor's own notification to the controller was late, record that - it affects both the timeline presented to the regulator and the commercial relationship.
Also check the other direction: the controller may itself be a processor for some of these employees' data, which would create a separate obligation to notify its own customers.
3. What should the lead tell the CEO about the 48-hour customer communication already scheduled?
Read the worked answer
That it is now a governed communication, not a marketing one. Anything said publicly in 48 hours will be read by regulators, employees, and plaintiffs' counsel as the company's position on the incident.
Practical guidance: keep it factual and limited to what is verified - the processor was compromised, the company is investigating, affected individuals will be contacted directly, and here is where to get information. Avoid speculation about whether data was taken, avoid characterizing the risk as low before an assessment supports it, and avoid language that could later contradict a notification.
Separate the audiences. Customers hearing from the company is not the same as individuals receiving a statutory communication; the former should not pre-empt or pre-announce the latter. And set an internal rule for the next 48 hours: one approved spokesperson, one approved set of facts, updated on a fixed cadence as forensics develops.
The CEO's instinct to protect the brand is right; the way to protect it is consistency, not silence.