Agent WranglersBreaches and reporting Required
Tell your customers when you are their processor
When you process data for business customers, tell each affected customer about a breach without undue delay and within the hours your agreement promises.
How to do it
Article 33(2) places this duty on processors. Your customers then have their own 72 hours, so promise 24 or 48 hours, not 72. Store a security contact for every customer account. Send the first notice with what you know, and update it as facts arrive.
How to check
Every customer account has a security contact. In a yearly drill, a test notice reaches every contact within the promised hours, measured from the drill's awareness time.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/processor-breach-notice.