Ask your vendor to notify you of a security incident affecting your data within a fixed number of hours, to a named contact, with defined content and regular updates. GDPR already says a processor must notify the controller without undue delay, but it sets no hour count for that step. Your contract can.
What the law says
GDPR Article 33 has two relevant rules. The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to risk people's rights and freedoms. And the processor "shall notify the controller without undue delay" after becoming aware of a breach.
The article does not give the processor a number of hours. That gap is where contracts earn their keep. If a vendor takes 60 hours to tell you, your 72 hour clock may be nearly gone. Our post on the GDPR 72 hour clock covers when the clock starts.
Clauses to request
- A time limit. Pick a number you can defend, such as 24 or 48 hours from awareness. Many teams ask for shorter times for critical vendors. Agree what you can enforce.
- Trigger wording. Define the incident that triggers notice: confirmed or suspected unauthorised access to, or loss of, your data.
- Named contacts. A monitored security address and a phone path, not a general support inbox.
- Minimum content. Article 33(3) lists what a breach notice must contain: nature of the breach, approximate numbers of people and records, contact point, likely consequences and measures taken. Ask the vendor to provide the same fields so you can reuse them.
- Staged updates. The article allows information to be provided in stages. Ask for updates at set intervals until closure.
- Cooperation. Help with investigation, logs and notices to affected people.
- Costs. Who pays for notification and forensics where the vendor is at fault.
- Subprocessor incidents. The vendor must pass on incidents at its own suppliers that affect you.
Test it
A clause nobody has tested may fail on the day. Once a year, send a test message to the vendor's incident contact and check that someone answers. Confirm your own internal route as well: who receives the vendor notice, and who decides whether to notify the regulator.
Keep expectations realistic
Smaller vendors may resist very short windows. Offer trade-offs: a shorter initial notice with less detail, followed by a fuller update. The goal is early warning, not a perfect report.
Do not forget non-personal data
GDPR covers personal data. If a vendor holds your source code or credentials, the law may not require any notice, so the contract must. Write the trigger to cover your confidential data too.
Quick check
Does GDPR give processors a number of hours to notify?
No. Article 33 says without undue delay. Put a number in the contract.
Who notifies the regulator, the vendor or me?
The controller notifies the supervisory authority under Article 33. The processor notifies the controller.
Sources
Last reviewed: 19 October 2026.
