Ransomware at a dental group: the 72-hour clock and the encryption argument

It is a breach. Article 4(12) covers a confidentiality, integrity or availability incident. Ransomware that encrypts a treatment server is at minimum an availability breach, and the 11 days of interactive access create a credible confidentiality risk.

The clock. Article 33(1) requires notification to the supervisory authority without undue delay and where feasible within 72 hours of becoming aware. Awareness means a reasonable degree of certainty that a security incident has occurred leading to personal data being compromised; it does not require full forensic certainty. Zahnwerk was aware on Monday at 09:00, so the deadline was Thursday 09:00. It can still notify late under Article 33(1) second sentence, with reasons for the delay, and it can notify in phases under Article 33(4) as facts develop.

The contractor's argument fails. Encryption is relevant, but Article 34(3)(a) only lifts the data subject notification duty where the data is unintelligible to unauthorised persons and, critically, the key has not been compromised. Here the attacker had interactive access to a live server, so the group cannot show the keys were unreachable; and the data may have been copied in the clear before encryption. Restoring from backup fixes availability, not confidentiality.

Processor point. The five-working-day contractual window cannot extend a statutory duty. Under Article 33(2) the processor must notify the controller without undue delay, so the contractor should have reported internally as soon as it had grounds for suspicion.

Risk assessment. Special category health data (HIV prophylaxis) for 600 individuals, plus 21,400 general treatment records, means a notification is almost certainly required under Article 33(1); non-notification would need to be justified as unlikely to result in a risk, which cannot be done here.

The test. Article 34(1) requires communication to data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. This is a higher threshold than the Article 33 'risk' test; some breaches require regulator notification only.

Applying it. Several factors push this towards high risk: health data is a special category under Article 9; the HIV prophylaxis flag is the most sensitive possible identifier; the attacker had 11 days of interactive access; and exfiltration cannot be excluded. Identity or financial harm is plausible through targeted phishing or extortion based on treatment status. The likely conclusion is that high risk exists and patients must be told.

Exceptions under Article 34(3). None is comfortably available. Encryption applies only where the data remains unintelligible and the key is uncompromised, which cannot be shown. Subsequent measures that eliminate the risk do not help, because restoring from backup does not undo 11 days of access.

Proportionality and form. Article 34(2) requires plain language describing the nature of the breach, the contact point, likely consequences and measures taken. Public communication is permitted only where individual communication would involve disproportionate effort; here email and postal addresses are on file, so individual notice is feasible. A targeted approach makes sense: prioritise the 600 flagged patients for individual contact, and notify the remaining 21,400 in the same wave unless the assessment shows a materially lower risk for them.

Also required. A contact route for questions, advice on phishing vigilance, and a record of who was notified and when.

Documentation.

1. Breach register (Article 33(5)). Record the facts, timeline, effects and remedial action for this incident, whether or not notification is made. This is the first thing the Austrian DSB will ask for.
2. Notification content (Article 33(3)). Nature of the breach, categories and approximate numbers of data subjects and records, contact point, likely consequences, measures taken. Phased notification is allowed if the facts are still developing.
3. Internal decision record. Why notification was or was not made, who decided, and on what evidence. The contractor's opinion should not be the only record.

Structural fixes.

• Article 28 contract. Rewrite the processor terms: notification without undue delay, assistance with Article 33 and 34, documented instructions, audit rights, and a security schedule. The five-working-day clause should be removed.
• Article 32 security. Address the unpatched VPN, remote access controls, MFA, network segmentation and patch management, and test restoration.
• DPO question. Article 37 does not oblige every dental group to appoint a DPO, but large-scale processing of health data by a controller as a core activity does trigger it. With 22,000 patients and special category data across 14 practices, Zahnwerk should document a formal assessment of whether Article 37(1)(c) applies, and in the meantime designate a named privacy contact and a point of contact for the authority.
• Governance. Training, an incident response plan with named decision-makers, and a review of the Article 30 records of processing, which are likely incomplete.