Not automatically. Whether you must notify customers depends on your contracts and on the law that applies to you, which usually turns on whether customer data or systems were affected. If a bad package never ran in production and nothing reached customer data, notification is often not triggered, but you should document why. This is not legal advice.
What the law actually keys on
Take GDPR as one example. Article 33 requires a controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. Even then, the controller must document the breach. A processor must tell the controller without undue delay. The trigger is a personal data breach, not the presence of a malicious package.
A decision path
- Did the bad version ever execute? If not, stop here and document.
- Where did it execute: developer machine, CI, staging or production?
- What could that environment read: customer data, production credentials, secrets that unlock customer data?
- Is there evidence of exfiltration or misuse?
- Do your customer contracts set their own notice duties, which are often stricter than the law?
| Situation | Typical outcome |
|---|---|
| Present in a lockfile, never built | No notification, record the search |
| Ran in CI with no production access | Rotate secrets, internal record, often no notice |
| Ran in CI with production credentials | Assume exposure, assess data access, may notify |
| Ran in production or exfiltration seen | Likely notification duties, involve counsel |
Document your reasoning
Write a short record: what you found, the window, the evidence, the decision and who approved it. A regulator or customer reviewing later cares less about the answer than whether you reasoned from evidence. See how to answer when a customer asks if you were affected.
Voluntary notice
Some teams tell customers even when not required, to show control. If you do, keep it factual and short, and agree it with counsel first.
Contracts often decide first
Many customer agreements set notice periods and triggers that are shorter or broader than the law. Read the clauses before you decide, and check whether they refer to security incidents in general or only to confirmed data breaches. If you act as a processor, you also owe your customers an alert without undue delay once you become aware of a breach. Sales and legal should know about the clause list before an incident, not during one.
Quick check
Does a malicious dependency count as a personal data breach?
Only if it led to unauthorised access, loss or disclosure of personal data. Presence alone does not.
Who decides whether to notify?
Usually legal and security leadership together, using the evidence record and contract terms.
Safeguard's compliance and evidence automation can help keep records of controls and decisions organised. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
