A processor detects unauthorised access to personal data it processes for a controller and plans to mention it only at the next monthly quarterly business review. What timing obligation applies?
Select an answer to reveal the explanation.
Short Explanation
Waiting for the monthly slide deck is not ‘without undue delay.’ When a processor spots a breach, it rings the controller promptly—not on the next tea-and-metrics calendar invite. Remediation plans do not buy a polite delay.
Full Explanation
The processor must notify the controller of the personal-data breach without undue delay after becoming aware of it under Article 33(2). Planning to mention unauthorised access only at the next monthly quarterly business review fails that timing standard and can prevent the controller from meeting SA and individual notice duties. Monthly QBR reporting does not always satisfy processor breach-notice timing. Processors may not wait indefinitely while remediating before telling the controller. Only the supervisory authority need not hear from the processor first—the controller is the required first recipient of processor notice. Exam caveat: without undue delay to the controller—not the next commercial meeting. Operational check: require 24/7 breach-notice contacts in civic DPAs and test processor escalation with a tabletop that forbids waiting for a QBR. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.