A vendor breach can start your own notification clock, so contracts should require fast, specific notice. GDPR requires a processor to notify the controller without undue delay, HIPAA gives a business associate up to 60 days to notify the covered entity, and NYDFS counts incidents at third party providers. This is education, not legal advice.
What the rules say about vendors
GDPR. Article 33(2): the processor shall notify the controller without undue delay after becoming aware of a breach. The controller's own 72 hour period under Article 33(1) runs from the controller's awareness.
HIPAA. Section 164.410 requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The notice should identify each affected individual to the extent possible and provide the information the covered entity needs for its own individual notices.
NYDFS 500.17. The 72 hour notice is triggered by a determination that an incident occurred at the covered entity, an affiliate or a third party service provider.
Why the legal maximum is not a good contract term
A regulation sets the outer limit for a vendor. A 60 day window would eat the whole of your own deadline. Contracts commonly ask for much shorter windows, a matter for your counsel and the negotiation. The point is to leave you time to act inside your own period.
Clauses worth asking for
- A short notice period from the vendor's awareness, measured in hours or a few days, with a named contact channel that works at night.
- Defined content. What happened, what data of yours, which individuals or counts if known, what the vendor has done, who to call.
- Updates. Regular follow ups as facts develop, since phased information is normal.
- Cooperation. Access to logs and people needed for your own notices and any regulator questions.
- Subprocessor flow down. The same duties for their vendors.
- Data location and return. Where your data sits and how you get it back.
- Cost and control of notices. Who writes and sends notices to individuals, and who pays.
For financial sector firms in the EU, DORA's Article 30 adds its own required contract elements; see our DORA checklist.
Make the clause usable
A clause nobody can act on is decoration. Keep an inventory of which vendors hold which data so that when a notice arrives you can tell within minutes whether it affects you. Practise a vendor incident in a tabletop. Test that the contact addresses in the contract still work.
Safeguard's asset discovery and compliance and evidence automation can help keep the vendor and system inventory current, though the contract terms are yours to negotiate.
Quick check
If our vendor is breached, is it automatically our breach?
Not automatically, but it can start your own clock, depending on the rule and the facts. Ask counsel quickly.
Is 60 days an acceptable vendor notice period?
HIPAA's text sets 60 days as a maximum for business associates. It leaves little room for your own deadlines, so shorter contract terms are common.
Sources
Last reviewed: 19 October 2026.
