When a buyer asks how quickly you will notify them of a security incident, commit to a window you can meet, define what triggers the clock, and say who gets the message. Under the GDPR, a processor must inform the controller promptly after becoming aware of a personal data breach.
What Article 33 says
For controllers, the GDPR says to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to risk people's rights and freedoms. If notice is later, the controller must explain the delay. For processors, the article requires informing the controller promptly once the processor becomes aware.
The 72 hours belongs to the controller, who is your customer. If you wait two days to tell them, they have one day left. That is why buyers push for short windows.
What to commit to
Common contract asks are 24, 48 or 72 hours from confirmation. Pick based on what your incident process can deliver. Consider:
- Trigger. "Becoming aware" and "confirming" are different moments. Define yours.
- Channel. A named contact, not a general helpdesk.
- Content. What you will include in the first notice and what follows later, since early facts are incomplete.
- Updates. How often you will update during an ongoing event.
Sample wording
"We will notify affected customers without undue delay after we confirm an incident involving their data, and within the period in our agreement. The first notice goes to the security contact on file and states what we know, what we do not yet know and what we are doing. We provide updates as facts develop."
Replace "the period in our agreement" with a specific figure only if your policy supports it.
Make the promise testable
Run a tabletop exercise that includes the notification step. Time it. If drafting and approval take three days, a 24 hour promise is fiction.
Keep customer contacts current
Notification fails when the contact is a former employee. Collect a security contact at onboarding and confirm it yearly.
Related questions
Buyers also ask about incident response plans, testing frequency and post incident reviews. Keep these in your answer library. See building an answer library.
Sources
Quick check
Does the 72 hours apply to us as a vendor?
It applies to the controller. As a processor you must inform the controller promptly, and your contract may set a shorter or specific period.
Should we promise to notify for any security event?
No. Scope the promise to incidents that affect customer data or service, as defined in your policy.
Last reviewed: 19 October 2026.
