Key takeaway
Containment does not restart awareness, and the supervisory-authority threshold differs from the threshold for informing people.
Record events before arguing about the deadline
An evaluation sample sent through the wrong access route can trigger an incident response even if the intended recipient later deletes its copy. Preserve the version, access evidence, affected fields and event times. Stop unnecessary access while the incident owner establishes what happened; do not make deletion confirmation the only record of the event.
For EU GDPR review, Article 33 distinguishes controller notification to the supervisory authority from the processor’s prompt alert to its controller. Article 34 separately addresses communication to affected people. The controller’s 72-hour period runs from awareness, with notification without undue delay and a risk-based exception; it is not a routine waiting period.
Reconstruct one hypothetical Sunday incident
In this hypothetical UTC timeline, a processor notices an ambiguous download log at 08:10 on 11 October 2026. Its 08:20 alert reports an unconfirmed security incident: it does not yet establish whether personal data left the approved access scope. Both parties investigate promptly. At 09:00, the controller obtains evidence giving reasonable certainty that personal-data sample bytes were exposed. It restricts the link at 09:15. These are invented events, not a report of an actual VOID incident.
Under those assumptions, the illustrated 72-hour point is 09:00 UTC on 14 October. If the processor instead informed the controller of an established personal-data breach at 08:20, awareness would in principle start then and the point would be 08:20 on 14 October. Further investigation does not grant a new clock. Neither time is permission to wait until Wednesday: a notifiable breach requires action without undue delay, with phased information where the requirements are met.
| Illustrative event | Time, UTC | Effect on the review |
|---|---|---|
| Ambiguous download log discovered | 11 Oct, 08:10 | Preserve evidence and investigate promptly |
| Unconfirmed incident alert | 11 Oct, 08:20 | Prompt investigation; confirmed breach notice would start awareness here |
| Evidence establishes personal-data compromise | 11 Oct, 09:00 | Stipulated awareness only under the unconfirmed-alert assumptions |
| Link restricted | 11 Oct, 09:15 | Contain exposure; awareness time remains 09:00 |
| 72 hours after awareness | 14 Oct, 09:00 | Outer timing reference, subject to without-undue-delay duty |
| Alternative: 72 hours after confirmed 08:20 notice | 14 Oct, 08:20 | 72-hour point uses earlier awareness; no investigation extension |
Separate suspicion from awareness without delaying investigation
The EDPB explains awareness in terms of a reasonable degree of certainty that a security incident has compromised personal data. That allows a short initial investigation into an ambiguous alert, not an indefinite investigation before acknowledging an evident breach. Write the evidence available at each time and who made the assessment.
For the example, the 08:10 log initially shows an unknown account and does not establish what bytes were downloaded or whether access was unauthorized. By 09:00, evidence establishes that personal fields were accessible outside the agreed group. Preserve that change in knowledge. The EDPB distinguishes an initial uncertain incident from a processor informing its controller of a breach: in the latter case, the controller is in principle aware when informed. Later analysis of additional files must be appended, without resetting awareness. Use one time zone and retain the original timestamps.
Make two risk decisions and retain both
Supervisory notification and communication to individuals use different thresholds. The controller should assess likelihood and severity for affected people, not just embarrassment to the business or the sample’s low row count. Article 33 also requires a breach record. A conclusion that notification is unnecessary needs its reasoning preserved.
The completed hypothetical review below keeps the decisions open where facts are missing. A statement that the recipient is trusted may matter to risk, but it does not erase the event. Encryption is relevant only after establishing what protection applied to the exposed information and whether it was unintelligible to the unauthorized party. A password delivered alongside the file needs its own factual assessment.
| Question in the invented case | Known evidence | Decision owner / unresolved point |
|---|---|---|
| Did personal data leave the approved access scope? | Confirmed sample bytes and access logs | Controller documents breach facts |
| Is risk to rights and freedoms unlikely? | Contact details present; onward access unverified | Privacy lead evaluates authority notification |
| Is high risk likely for affected people? | Sensitive field extent still being checked | Privacy lead evaluates individual communication separately |
| What containment is verified? | Link revoked; original download remains possible | Incident lead obtains handling evidence and records limits |
Preserve the sample and permission boundaries
Retain a controlled incident evidence copy and the permission record according to the incident team’s instructions. Do not broadly resend the sample to demonstrate the problem. A file hash can connect logs to a version, but cannot establish who read the contents or whether another copy exists. Record where access evidence is incomplete.
Check which party was controller or processor for the actual operation; a company’s role is not determined solely by the label evaluator. Identify the appropriate authority and required content with the responsible privacy adviser. No notice is submitted by this worksheet. The organization’s real incident process must decide and execute any communication, including necessary updates and explanations for delay.
Close the event with an evidence record
For the hypothetical incident, the useful output is a timestamped facts log, two separate notification decisions and a containment record with remaining uncertainties. Assign an owner for each follow-up and preserve what was known when the decision was made. A later clean build or a revoked link is not proof that the incident has been resolved.
Secure evaluation explains how to bound the original test; this article deals with a specific unauthorized exposure after delivery. Rights & privacy review can organize roles and unresolved categories, but it is not an incident-response service and does not decide notification. Resume external evaluation only after the responsible organization approves the revised access and sample scope.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.