Friday 16:00 - The 72-Hour Clock With Half the Facts
Calder Health is a private company with customers in the EU and the US. On Friday at 16:00 the security team confirms that an unauthorised party accessed its support ticketing system between 2 March and 20 March. Approximately 4,200 tickets include attachments such as scanned identity documents, and 60,000 customer email addresses were exposed. It is not yet established whether the attacker downloaded the attachments, or whether a third-party support vendor with legitimate access was the source. The forensic firm says scoping will take five working days. Counsel advises waiting for the facts before notifying anyone. On Saturday the attacker emails three customers threatening to publish data. The DPO is on leave; the data protection authority's contact line closes at 17:00 on Friday and reopens Monday.
1. When does the notification clock start, and what do you do given that the facts are incomplete?
Read the worked answer
The clock started at 16:00 on Friday.
Article 33 GDPR requires notification to the supervisory authority within 72 hours of the controller becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to rights and freedoms. Regulatory guidance treats awareness as the point at which the controller has a reasonable degree of certainty that a security incident has occurred which led to personal data being compromised. It is emphatically not the point at which the investigation is complete. Access is confirmed, personal data is in the accessed system, and the categories are serious. Nothing here supports "unlikely to result in risk". The deadline is Monday 16:00.
Counsel's advice to wait five days is wrong as a compliance matter, and the disagreement should be escalated and recorded rather than resolved informally. Waiting for scoping is not a lawful basis for delay.
Use phased notification. Article 33(4) expressly permits notification in phases where it is not possible to provide all information at once, provided the reasons for the delay are given. So submit by Monday 16:00 with what is known, state precisely what is not yet known, describe the investigation underway, and commit to a follow-up. A partial, timely notification is far better than a complete, late one.
Practical steps: reach the DPO's deputy on Friday; the 17:00 phone line closing is irrelevant - most authorities accept online submissions and the deadline does not move. Document the awareness timestamp, the reasoning, and who decided what, because that record is the first thing a regulator will ask for.
2. Decide what you tell the authority, the 4,200 affected individuals, the 60,000 customers, and the support vendor. Justify the phasing.
Read the worked answer
Supervisory authority - mandatory, by Monday 16:00. Include the nature of the breach, the categories and approximate numbers (4,200 tickets with identity documents, 60,000 email addresses), the DPO contact, likely consequences, and measures taken and proposed. Do not wait for the download-versus-access question: state that it is unresolved.
The 4,200 - notify without undue delay. Article 34 requires communication to data subjects where the breach is likely to result in a high risk to their rights and freedoms. Scanned identity documents create identity-fraud and account-takeover risk; that is high risk on its face. The attacker contacting customers directly on Saturday raises the likelihood further and removes any argument for delay. If phasing is necessary, start with these people and say so plainly.
The 60,000 - assess separately. Email addresses alone are lower risk, though they enable convincing phishing, especially in a health context. Notifying them is defensible and probably advisable, but do not let the larger, easier group delay the 4,200 who face identity fraud. Decide, document, and be consistent.
Contractual and customer notices. Check your customer agreements for processor or controller role and for notification windows, which are often 24 or 48 hours and are frequently shorter than the regulatory deadline. Notifying customers late is a contract breach independent of GDPR.
The support vendor - immediately. It may be the source, and it has its own notification duties. Telling it is not an admission about it; it is a required step in establishing what happened.
Content discipline: factual, specific, no speculation about the attacker, no naming, practical advice, and a contact channel. Overstating and understating both create liability. If US state breach laws apply, check their clocks too - they vary and some are shorter than 72 hours.
3. The attacker has emailed customers and demands payment. How do you handle contact with them and with law enforcement, and what are the legal and ethical constraints?
Read the worked answer
Decide with counsel, not in the SOC. There is no obligation to reply, and replying from a corporate mailbox is itself a decision with evidentiary and legal consequences. Any communication must be preserved and logged, and should run through a single designated channel with counsel involved.
Payment is not a technical decision. In many jurisdictions paying is not per se illegal, but there are hard constraints:
- Sanctions screening is mandatory before any transfer. Paying a sanctioned entity is a criminal exposure, and "we did not know" is a weak defence given the lists are public and screening is routine.
- Payment buys no guarantee. Many payers are re-extorted, and decryption keys are frequently defective. Evaluate against restoration from backup.
- Some jurisdictions restrict or require reporting of payments, particularly involving critical infrastructure, and insurers and regulators increasingly expect documented consideration of alternatives.
The ethical question is separate from the legal one: the funds finance further attacks on organisations like yours, and that should be weighed explicitly rather than buried in a cost-benefit note.
Law enforcement. Engage early - report the extortion, preserve email headers in full, and follow guidance on whether public disclosure would compromise an operation. But understand two boundaries: engaging law enforcement does not pause the GDPR clock and does not substitute for authority notification; and if investigators ask you to delay notifying individuals, get that request in writing, weigh it against Article 34, and let counsel document the legal basis. A verbal request from an investigator is not a defence.
Ethically, the affected people's interest in knowing outweighs reputational preference. The three customers already contacted by the attacker know something; silence now looks like concealment later.