An EU-based retailer runs its customer portal on a public cloud platform. Its investigation confirms that personal data of EU residents was exfiltrated and that the breach is likely to result in a risk to those individuals' rights and freedoms. Acting as the controller under the GDPR, which communication obligation applies to the retailer?

Under the GDPR the controller, the party that decides the purposes and means of processing, must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If information is not yet complete, it may be provided in phases, and any delay beyond 72 hours must be explained. Handing the duty to the cloud provider misreads the roles: a provider acting as processor must inform the controller without undue delay, but the regulatory notification remains the controller's obligation. Notifying individuals first and deferring the regulator to an annual filing inverts the rule; communication to data subjects is a separate duty triggered by a high risk, and it never replaces the authority notification. Waiting for the forensic investigation to finish ignores the phased-reporting provision that exists precisely so investigation does not stall notification. Exam caveat: other regimes such as HIPAA or national breach laws set different triggers and deadlines, so the 72-hour figure is specific to the GDPR. Operational check: confirm the incident response plan records the time of awareness, names who files with the lead authority, and holds a template for phased updates.