Chapter 47 — Failure and recovery trial
Lesson map
Lesson 47 published. Map, example, EX139.
flowchart TD
N0["Learning outcomes"]
N1["47.1 The scenario"]
N2["47.2 The clock"]
N3["47.3 Communicating with patients"]
N4["47.4 Improvements"]
N5["Lab — Breach timeline against the 72-hour clock"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX139"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["47.1 The scenario"]
N2["47.2 The clock"]
N3["47.3 Communicating with patients"]
N4["47.4 Improvements"]
N5["Lab — Breach timeline against the 72-hour clock"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX139"]
[Learning outcomes]
|
v
[47.1 The scenario]
|
v
[47.2 The clock]
|
v
[47.3 Communicating with patients]
|
v
[47.4 Improvements]
|
v
[Lab — Breach timeline against the 72-hour clock]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX139]
Learning outcomes
You will (1) run a breach exercise against a legal clock; (2) assess vendor notification delays; (3) improve response based on the trial.
47.1 The scenario
Pellmore runs a breach exercise with Zara as an observer. In the synthetic scenario, the chat vendor detects an unusual export at 22:00 on 2 March. The vendor tells Pellmore at 09:30 on 4 March. Pellmore confirms that personal data are involved at 15:00 the same day. Article 33 of the GDPR requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and Article 33(2) requires the processor to notify the controller without undue delay after becoming aware. The exercise uses synthetic records only.
47.2 The clock
The lab computes the timeline. Pellmore became aware at 15:00 on 4 March, so the 72-hour deadline is 15:00 on 7 March. Pellmore notified the authority at 11:00 on 6 March, 44 hours after awareness, on time. Patients were informed on 8 March. But the vendor took 35.5 hours to tell Pellmore after detecting the export. EDPB Guidelines 9/2022 explain when a controller becomes aware and emphasise prompt action. Zara notes that the vendor delay, not Pellmore's own process, is the weakest link in the timeline. The scenario's vendor reported after several days of delay.
47.3 Communicating with patients
Article 34 requires informing patients without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The exercise team debates whether chat logs about symptoms meet that threshold and decides they do. The communication must describe the nature of the breach in clear language, the likely consequences, the measures taken and a contact point. Zara helps draft the message, avoiding jargon and giving practical steps, such as watching for phishing messages that refer to their consultations.
47.4 Improvements
After the exercise the team lists improvements: a contractual requirement for the vendor to notify within twelve hours of detection, a pre-approved patient message template, and a decision tree for assessing high risk. They also record that the internal process met the deadline comfortably. Zara adds the exercise results to the evidence dossier. She reflects that exercises reveal dependencies on others, such as vendors, that internal tests miss, and that recovery depends as much on contracts and communication as on technology. Contracts now set a twelve-hour clause.
Lab — Breach timeline against the 72-hour clock
# Breach timeline against the GDPR Article 33 72-hour clock, which starts when the controller becomes aware.
from datetime import datetime as D, timedelta
ev = [("vendor detects unusual export", D(2026, 3, 2, 22, 0)), ("vendor tells Pellmore", D(2026, 3, 4, 9, 30)),
("Pellmore confirms personal data involved (aware)", D(2026, 3, 4, 15, 0)),
("initial notification to supervisory authority", D(2026, 3, 6, 11, 0)),
("affected patients informed", D(2026, 3, 8, 10, 0))]
aware = ev[2][1]; deadline = aware + timedelta(hours=72)
for name, t in ev:
print(f"{t:%d %b %H:%M} {name}")
h = (ev[3][1] - aware).total_seconds() / 3600
print(f"deadline {deadline:%d %b %H:%M}; notified after {h:.0f} h -> {'on time' if h <= 72 else 'LATE'}")
print(f"vendor-to-controller delay {(ev[1][1]-ev[0][1]).total_seconds()/3600:.1f} h (Art 33(2): without undue delay)")
Run with python3 lab_breach.py. Verified output:
02 Mar 22:00 vendor detects unusual export
04 Mar 09:30 vendor tells Pellmore
04 Mar 15:00 Pellmore confirms personal data involved (aware)
06 Mar 11:00 initial notification to supervisory authority
08 Mar 10:00 affected patients informed
deadline 07 Mar 15:00; notified after 44 h -> on time
vendor-to-controller delay 35.5 h (Art 33(2): without undue delay)
Worked example
Zara's exercise shows Pellmore notifying 44 hours after awareness, inside the deadline of 15:00 on 7 March, but the vendor taking 35.5 hours to inform Pellmore, leading to a twelve-hour contractual target.
Synthetic case. The breach is a synthetic exercise; GDPR Articles 33 and 34 and EDPB Guidelines 9/2022 are real.
Errors and limits
Exercises run with known scenarios; real incidents are messier and slower to understand.
Exercises
- EX139 — Deadline. When was the 72-hour deadline in the exercise? Rubric: 3 = 15:00 on 7 March;; 2 = right day;; 1 = wrong;; 0 = none.
- EX140 — Weak link. What was the weakest link in the timeline? Rubric: 3 = the vendor's 35.5-hour delay before telling Pellmore;; 2 = mentions vendor;; 1 = internal process;; 0 = none.
- EX141 — Patient message. What must the patient communication contain? Rubric: 3 = nature of breach, likely consequences, measures and contact point in clear language;; 2 = lists some;; 1 = vague;; 0 = none.
Synthesis
Chapter 47 tests recovery. Chapter 48 assembles the evidence dossier.
Continue studying — chapter 47 of 50
← Chapter 46 (draft) · Course chapter index · Chapter 48 (draft) →