The 71-Hour Breach Clock

The controller (each tenant) bears the 72-hour regulator notification duty. The processor must notify the controller without undue delay on becoming aware - it has no independent 72-hour regulator clock.

Clock mechanics:

• Awareness starts when the processor has a reasonable degree of certainty that a security incident has occurred leading to personal data compromise - not when root cause or full scope is known. Here that threshold is crossed by Friday evening/Saturday morning at the latest (confirmed unauthorised access via a token with data-returning capability).
• The processor's 'without undue delay' duty therefore bites now, not Monday. Waiting for complete scoping is the error the CTO is proposing.
• The controller's 72 hours then starts when it becomes aware - which, if the processor notifies promptly, is essentially the same window. A Saturday notification to controllers means their deadline lands early the following week; weekends do not pause the clock.

So: processor notifies the three tenants immediately with what is known, marked as an initial notification to be updated. Controllers then assess whether their own 72-hour duty is triggered.

The healthcare tenant almost certainly must notify. Reasoning:

• Threshold: notification is required unless the breach is unlikely to result in a risk to rights and freedoms. A tenant-isolation bypass on a healthcare dataset is high-risk on its face: confidentiality of health data, potential special-category data, and possible identifiability.
• Uncertainty is not a reason to wait. The standard is a reasoned assessment, not certainty. Where risk is plausible and scoping is incomplete, the correct move is to notify within 72 hours describing the nature of the breach, likely categories and approximate numbers, the DPO's contact, likely consequences, and measures taken - explicitly flagged as phased, with further information to follow. Regulators expect and permit this.
• 'Undue delay' means the controller cannot sit on notification while it finishes forensics. If full details genuinely cannot be provided at once, they may be provided in phases without further undue delay.
• Individuals: if the breach is likely to result in high risk to individuals (plausible for health data), the healthcare tenant must also communicate to affected data subjects without undue delay - subject to the narrow exemptions (e.g. encryption making data unintelligible, or disproportionate effort with a public communication instead).

The defensible position: notify the regulator within 72 hours with a phased description; do not wait for Monday's scoping.

The retailer may decide not to notify the regulator, but only on a documented risk assessment. It must record:

• The facts known at the time and the reasoning that risk is unlikely - e.g. order references and postcodes alone, no names, no payment data, low re-identification risk.
• The decision, the decision-maker, and the date.

Residual obligations:

1. Internal breach register. Every breach must be logged regardless of whether it is notifiable; the register supports accountability and any later regulator query.
2. Reassessment trigger. If scoping later reveals names or more identifiers were in fact exposed, the assessment must be revisited - and if risk becomes likely, notify without undue delay, explaining the delay.
3. Processor follow-up. The retailer should press the processor for the completed scope and keep a record of what it was told and when.
4. Contractual posture. Check the processor agreement for notification timelines and cooperation duties; a processor that waited until Monday would be in breach of 'without undue delay'.

The exam point: 'we decided not to notify' is only defensible if it is written down and reasoned, not asserted after the fact.