HR Analytics Rollout Across Three Jurisdictions
Northwind Logistics runs a cloud HR analytics platform for 2,800 staff: 180 in Ireland, 90 in a Shanghai joint venture, and the rest in Singapore. The vendor hosts in us-east-1 and ingests performance ratings, salary bands, and sick-leave records, including physiotherapy notes. The Irish works council has challenged the transfer, and the Shanghai JV's legal team says employee consent forms were collected in 2023 but never covered analytics. Last Tuesday a researcher reported an S3 bucket containing 3,100 onboarding records - names, national ID fragments, bank account numbers - that had been publicly readable for 11 days. CloudTrail shows 42 GET requests from four unfamiliar IP ranges, but server access logging for that bucket was disabled. The DPO wants to notify every affected person within 24 hours; the CISO wants to wait for forensics; the China JV asks whether the incident must go to the CAC. Outside counsel is capped at EUR 40,000 and the board meets in five days.
1. Identify every notification obligation triggered by the exposure, with the deadline and the facts that determine whether each is mandatory.
Read the worked answer
Start the clock at awareness, not at the researcher's email. The company learned of the exposure when the report was received; the 72-hour GDPR clock runs from that point, and forensics does not pause it.
- GDPR (Ireland as main establishment). Art. 33 requires notification to the supervisory authority within 72 hours unless the breach is unlikely to result in a risk. Names plus national ID fragments and bank details support identity theft and payment fraud, so the risk is not unlikely. Art. 34 requires notification to affected individuals without undue delay where there is a high risk. Notify the EU residents among the 3,100; the DPO's 24-hour target is lawful, but the notice must still contain the Art. 33(3)/34(2) content and can be updated.
- Singapore PDPA. A breach is notifiable to the PDPC within 3 calendar days of the assessment if it causes or is likely to cause significant harm, or affects 500 or more individuals. 3,100 records crosses the threshold; notify the PDPC and the affected Singapore staff.
- China PIPL. Art. 57 requires immediate notification to individuals and the regulator, with the type of data, cause, likely harm, remediation and contact. The 90 Shanghai JV employees and any Chinese data subjects are in scope. Whether a CAC security assessment is separately triggered depends on volume and whether the data is important data; the cross-border flow is a separate question.
- Contract. The vendor's DPA likely requires notice to the bank as controller; the bank remains responsible for its employees' data.
The 42 GETs from four unfamiliar ranges do not prove exfiltration, but with access logging disabled the company cannot exclude it. That uncertainty pushes toward notification rather than away from it.
2. The vendor proposes keeping us-east-1 and adding AES-256 encryption with vendor-managed keys. Evaluate whether that makes the transfers lawful, and state what would.
Read the worked answer
No. Server-side encryption with vendor-managed keys is close to irrelevant to transfer lawfulness. If the bucket is public, anyone who can read the object receives plaintext over HTTPS; SSE-S3 or SSE-KMS decrypts transparently for the reader. If the vendor holds the keys, the vendor can also be compelled to disclose, so the encryption does not defeat foreign government access - the core concern in a transfer impact assessment.
To make US processing defensible, the company needs:
- A transfer mechanism - EU SCCs/IDTA plus a documented TIA for the EU data; for China, one of the PIPL Art. 38 routes: CAC security assessment if thresholds are crossed, a filed standard contract, or certification. Employee consent alone is not a substitute where a mechanism is required.
- Data minimisation - do not send physiotherapy notes or national ID fragments to the analytics vendor. Health data is special-category under GDPR and sensitive personal information under PIPL; aggregate it or keep it in-region.
- Technical supplementary measures - EU or in-country processing, customer-managed keys or hold-your-own-key, pseudonymisation before ingestion, and access controls the vendor cannot override.
- Governance - DPIA, works council consultation, records of processing, and a vendor audit right.
Encryption with vendor-managed keys is a useful baseline control, but it is not a transfer solution.
3. After the 11-day exposure, how should the company assess risk to individuals, and what evidence changes the notification decision?
Read the worked answer
Assess likelihood and severity against the data and the evidence, and document the conclusion.
Severity factors: names plus national ID fragments and bank accounts are a strong identity-theft and fraud combination. Onboarding records may also reveal salary or health information. The number affected is 3,100, and the exposure lasted 11 days.
Likelihood factors: the bucket was publicly readable, so discovery is plausible without authentication. CloudTrail recorded 42 GETs from four unfamiliar IP ranges. That is not proof of targeted exfiltration - scanners routinely hit open buckets - but the company cannot show the data was not downloaded because server access logging was off. If CloudTrail data events were enabled for S3, check whether the requests returned 200 or 403, which objects were touched, and whether the source IPs map to the researcher.
Encryption: if the objects were encrypted client-side with a key the reader did not have, risk falls sharply; SSE alone does not.
Decision: treat the incident as high risk for EU and Singapore notification, and notify under PIPL. Give individuals specific facts, not speculation, and update them if forensics changes the picture. Preserve logs, rotate exposed credentials, and fix bucket policy and logging centrally. Waiting for perfect attribution would breach the 72-hour deadline; notify on time with a caveat.