{"id":6369,"date":"2026-11-14T13:36:00","date_gmt":"2026-11-14T12:36:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=6369"},"modified":"2026-11-14T15:26:46","modified_gmt":"2026-11-14T14:26:46","slug":"breach-at-a-provider","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/","title":{"rendered":"What must the controller do when a provider reports a personal data breach?"},"content":{"rendered":"\n<p class=\"ll-art-meta wp-block-paragraph\"><a href=\"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/\"><strong>Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for DPOs and breach response teams \u2022 published November 14, 2026 \u2022 13 min read<\/p>\n\n\n\n<div class=\"wp-block-columns ll-art-shell is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column ll-art-rail is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-railinner is-layout-constrained wp-block-group-is-layout-constrained\">\n\n\n\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column ll-art-main is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-answer is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 id=\"krotka-odpowiedz\" class=\"wp-block-heading\">Short answer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The controller establishes with the provider whether the breach at a provider covered the controller&#8217;s data and limits the effects on its own side at once. It assesses the risk to individuals itself, and it is safer to count the 72 hours from the provider&#8217;s first message about the breach because according to the European Data Protection Board (EDPB) that is in principle when the controller becomes aware of it. Unless the risk is unlikely, it notifies the breach to the President of the UODO without undue delay and where feasible within 72 hours, providing missing information in phases (Article 33 GDPR). Where the risk is high it communicates the breach to data subjects, subject to the exceptions in Article 34(3), and it documents every breach at a provider even when it does not notify it.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-group ll-art-check ll-mi-wpis is-layout-constrained wp-block-group-is-layout-constrained\">\n<p class=\"wp-block-paragraph\"><strong>Has your provider notified you of a breach? Check what to do now<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The \u201cI have an incident \u2013 what now?\u201d tool shows the first steps after the provider\u2019s message and gives a preliminary indication of which deadlines under the GDPR and the Polish KSC Act are already running. At the end, you can download an action plan as a PDF. Free of charge, no account required and no cookies.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button ll-drugi\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.lablogic.pl\/i\/en-wiedza#vendor\">Check your case<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<h2 id=\"dlaczego-pytanie\" class=\"wp-block-heading\">Why this question arises at all<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Article 33(2) GDPR devotes one sentence to the processor. After becoming aware of a breach it notifies the controller without undue delay. The rules entrust notification to the supervisory authority and communication to data subjects to the controller. The GDPR does not set out the order of actions between the message from the provider and the notification.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In August 2026 the President of the UODO issued an announcement entitled \u201cThe controller must notify a leak that occurred at the processor\u201d. It was addressed to controllers that had entrusted data to the provider of the MyDr electronic medical records system. It recalled that an analysis of the risk to the rights or freedoms of natural persons is necessary. Notification to the authority and communication to data subjects depend on its outcome.<\/p>\n\n\n\n<h2 id=\"co-ustalic\" class=\"wp-block-heading\">What has to be established after the provider&#8217;s message<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The controller establishes the scope of the event in its own data and the moment of becoming aware of the breach. It also limits the effects on its own side at once. It then assesses the risk and decides on notification and communication. Whatever the outcome, it documents the breach. Where the event is also an incident within the meaning of the Polish KSC Act (Article 2(5)), an essential or important entity classifies it against the thresholds for a significant incident (Article 11(1)(3)). It submits an early warning of a significant incident to the competent sectoral CSIRT without delay and no later than 24 hours after its detection. It submits the incident notification without delay and no later than 72 hours after detection (Article 11(1)(4) and (4a)). A controller that is a trust service provider notifies a significant incident to the competent sectoral CSIRT without delay and no later than 24 hours after detection (Article 11(1a)). All these deadlines run from the detection of the significant incident and not from becoming aware of the personal data breach. These obligations do not apply in the banking and financial market infrastructure sectors (Article 8i(1)). The thresholds for a significant incident differ from the risk threshold in Article 33(1) GDPR. A controller subject to these obligations therefore classifies the incident against the thresholds and separately assesses the risk under Article 33(1) GDPR, because one assessment does not replace the other.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Did the breach at a provider cover the controller&#8217;s data<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The first question concerns scope. According to the announcement of the President of the UODO of 12 August 2026, before proceeding with the obligations under Article 33(1) and Article 34 the controller should receive from the processor information confirming that the incident concerned data connected with its activity. A general message about an \u201cincident in our systems\u201d does not contain such information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The controller has a basis for requesting it. The data processing agreement must stipulate that the processor assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR. That assistance takes into account the nature of processing and the information available to the provider (Article 28(3)(f)). The first answers may therefore be incomplete. The EDPB recommends that the provider promptly notifies the breach and provides further information in phases as more details become available (paragraph 45).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is worth including four requests in the first question to the provider.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>confirmation whether the event covered the data entrusted by this controller, with the categories and approximate number of individuals and records;<\/li>\n\n\n\n<li>a description of what happened and whether the data reached unauthorised persons or only became unavailable;<\/li>\n\n\n\n<li>information on the actions the provider has taken and on the timing of further findings;<\/li>\n\n\n\n<li>the period during which the data were exposed and the accounts and keys that may have been compromised.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These questions help to gather the information that the controller provides in its notification to the President of the UODO (Article 33(3)). The request is best sent through the contact channel named in the agreement, which leaves a record with the date and time. The same channel should be used to confirm that the message about the breach really comes from the provider, because high-profile leaks are sometimes exploited to impersonate providers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When the breach occurred at a sub-processor<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A service provider often engages further processors, for example a data centre or a cloud computing service. The provider must impose on such a sub-processor the same data protection obligations as it has towards the controller (Article 28(4)). Where that sub-processor fails to fulfil them, the initial provider remains fully liable to the controller for the performance of the sub-processor&#8217;s obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice the controller addresses its questions to its own provider, which is liable to it for the sub-processor. The controller&#8217;s obligations under Articles 33 and 34 do not change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When the controller starts counting the 72 hours<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">According to the EDPB the controller uses the processor to achieve its own purposes. Therefore in principle the controller should be considered aware once the provider has informed it of the breach (Guidelines 9\/2022, paragraph 44). The UODO guide adopts the same rule and adds that the controller remains responsible for verifying the information and for the final analysis and classification of the incident.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The announcement of the President of the UODO can be read as if the deadline started only with confirmation of the scope. It is safer to count the 72 hours from the provider&#8217;s first message about the breach, even when the confirmation has not yet arrived. A mere message that the provider is investigating a suspected incident is usually not yet information about a breach. According to the EDPB, however, preliminary actions after such an initial alert should in most cases be completed soon (paragraph 36). The message can be information about a breach when it already gives a reasonable degree of certainty that data have been compromised (paragraph 31). The UODO guide does not accept waiting for the end of an investigation or for complete information as a justification for delay. Where information is missing it points to an initial notification followed by a supplement (example 9.2.1).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The opposite also happens. The controller learns of the event from the media or from a patient before the provider writes to it. The EDPB then allows a short period of investigation during which the controller is not yet regarded as aware. The investigation should, however, begin as soon as possible. In most cases it should be completed soon after the initial alert and take longer only in exceptional cases (paragraphs 34 and 36).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In my assessment the provider&#8217;s silence does not extend the preliminary investigation after an alert from another source. Where the controller has a reasonable degree of certainty that the event covered its data, it becomes aware of the breach even without confirmation from the provider. This reading is supported by paragraph 31 of the guidelines, that is a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Paragraph 34 also links the start of a short investigation to the first information from an individual, a media organisation or another source. Against it stands the announcement of the President of the UODO, according to which the controller should receive from the provider information confirming that the incident concerned its data before performing its obligations. On the reading based on paragraphs 31 and 34 the absence of confirmation before the 72 hours expire does not hold back the notification. Unless the risk is unlikely, it is safer to submit an initial notification and supplement it without undue further delay after the provider&#8217;s answers (Article 33(4), UODO guide 9.2). The notification should state that the scope of the data is awaiting the provider&#8217;s confirmation and give the date of the questions. Whichever reading is adopted, it is worth recording when the questions were sent to the provider and when the answers arrived.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to the UODO guide the deadline also runs at weekends and on other non-working days. Detailed counting of the deadline is described in <a href=\"https:\/\/www.lablogic.pl\/en\/how-to-count-72-hours-for-breach-notification\/\">How to count the 72 hours for notifying a personal data breach?<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the provider does not know and the controller must assess<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">According to the EDPB the provider does not need to first assess the likelihood of risk before notifying the breach to the controller. It just needs to establish whether a breach has occurred and notify it. It is the controller that must make this assessment on becoming aware of the breach (paragraph 44).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The controller knows more about its data than the provider. It knows whether the data concern patients, children or employees. It knows what data it entered into the system and whether it holds a copy. The EDPB lists risk assessment factors, among them the type of breach and the nature, sensitivity and volume of personal data. Ease of identification of individuals, severity of consequences and the number of affected individuals also count (paragraphs 106 to 118). Two factors concern the individuals and the controller itself, so the controller usually knows them better than the provider. The first is special characteristics of the individuals, for example children. The second is special characteristics of the controller, for example a medical organisation (paragraphs 116 and 117). If in doubt, the controller should err on the side of caution and notify (paragraph 119).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The EDPB adds that the controller might want to investigate the breach itself, as the provider might not be in a position to know all the relevant facts. An example is a copy of the data destroyed or lost by the provider that the controller still holds. It may affect whether the controller would need to notify (paragraph 44). The UODO guide describes a fire at the provider&#8217;s servers holding backup copies. The controller established that it held its own complete copy of that data and according to the guide rightly did not \u201cbecome aware\u201d of a breach (example 5.2.4). A copy limits the effects of loss or destruction of data but does not remove the risk after unauthorised disclosure of or access to the data. Even in the case of loss it does not always close the matter. In its part on encryption the EDPB states that the loss of encrypted data may still be a reportable breach despite a backup. This depends on the time taken to restore the data and the effect that lack of availability has on individuals (paragraph 79).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to the UODO guide controllers should know the risk assessment process well enough to supervise it and to take the final decisions themselves in every case. They must also be ready to demonstrate that they assessed the risk properly and acted on that basis. For encrypted data the EDPB notes that the situation may change over time and the risk would have to be re-evaluated (paragraph 78). Every new piece of information from the provider is worth treating in the same way, for example confirmation of a leak after an earlier message about unavailability of data only.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the controller does itself before the provider completes its analysis<\/h3>\n\n\n\n<div class=\"wp-block-group ll-art-zdanie is-layout-constrained wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\">Remember<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Remedying the breach is not solely a matter for the provider.<\/p>\n\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">In its notification to the President of the UODO the controller describes the measures taken or proposed to be taken by itself to address the breach (Article 33(3)(d)). According to the UODO guide remedying breaches applies to all breaches the controller has become aware of, regardless of the outcome of the risk assessment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The controller can take some actions on its own side. In practice this means changing passwords and API keys and revoking active sessions in the provider&#8217;s service. It also means switching off integrations that fetch or send data. Sometimes access also needs to be restricted until the event is clarified. The UODO guide lists similar containment methods, including blocking accounts and isolating the systems affected by the breach. Some actions in the service can be performed only by the provider, for example forcing a password change for all of the controller&#8217;s users. Requests for such actions are best sent through the same channel as the questions, so that a record with the time remains. It is also worth revoking credentials to the controller&#8217;s systems that the provider stored, for example service accounts and integration tokens. Each such action is worth recording with the time, because it will go into the notification and the documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does the provider&#8217;s assessment release the controller<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It does not. The provider may write that in its view notification to the authority is not needed. For the controller such an opinion is one piece of information for the assessment and not a decision. The basis is paragraph 44 of the guidelines and the UODO guide, which assigns the final classification of the incident to the controller.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same applies to the provider&#8217;s announcement that it \u201cwill take care of the notification\u201d. According to the EDPB a processor could make a notification on behalf of the controller if the controller has given it the proper authorisation as part of the contractual arrangements. The legal responsibility to notify remains with the controller (paragraph 48). The UODO guide allows notification by the provider only with the controller&#8217;s written authorisation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who notifies a breach at a provider to the President of the UODO<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The controller notifies, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33(1)). According to the EDPB a provider serving multiple controllers affected by the same incident will have to report details of the incident to each of them (paragraph 47). Each of these controllers assesses the risk and, unless the risk is unlikely, notifies the breach in its own name. In a group of companies the obligation lies with each company that is a separate controller. Where companies in the group are joint controllers, the arrangement under Article 26 should determine which of them is responsible for notifying the breach and communicating it to data subjects (EDPB paragraph 42). A company that is a separate controller cannot rely on a notification that another group company submitted in its own name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The controller does not have to wait for the provider&#8217;s full report. Where and in so far as it is not possible to provide the information at the same time, the controller may provide it in phases without undue further delay (Article 33(4)). A notification made after 72 hours must be accompanied by reasons for the delay (Article 33(1)). The UODO guide does not accept as a justification for delay the leave of the person responsible without a substitute arranged or the management&#8217;s lack of time to approve the notification (example 9.2.1). The President of the UODO recommends using the notification form template available on the authority&#8217;s website. The UODO guide lists the electronic form on biznes.gov.pl, sending the completed form through ePUAP or as a general letter and traditional post.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When to inform data subjects of a breach at a provider<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The controller communicates the breach to data subjects without undue delay when it is likely to result in a high risk to their rights and freedoms (Article 34(1)). The communication describes in clear and plain language the nature of the breach and contains at least the information and measures referred to in Article 33(3)(b) to (d) (Article 34(2)). These are the name and contact details of the data protection officer or other contact point. They also include the likely consequences of the breach and the measures described in Article 33(3)(d).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Article 34(3) lists three situations in which the communication is not required. The first concerns appropriate protection measures applied to the data affected by the breach, in particular those that render the data unintelligible to unauthorised persons, such as encryption. The second concerns subsequent measures which ensure that the high risk is no longer likely to materialise. The third concerns disproportionate effort. In that last case there is instead a public communication or a similar measure informing data subjects in an equally effective manner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the announcement of 12 August 2026 the President of the UODO gave examples of the content of the communication. Where a PESEL number is involved, the controller may point to the risk of fraudulent loans and recommend restricting the number. Where health data are involved, it may point among other things to the risk of discrimination and propose psychological support in situations of severe stress or anxiety.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The provider may communicate the breach to data subjects on behalf of the controller. According to the UODO guide this requires written authorisation, and the matter should be precisely regulated in the agreement. The controller nonetheless remains ultimately responsible. According to the guide the provider must then state clearly in the communication who the controller is and who is acting on its behalf. The channel and language of the communication are described in <a href=\"https:\/\/www.lablogic.pl\/en\/how-to-notify-data-subjects-of-a-breach\/\">How do you notify data subjects of a breach and what must the communication contain?<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to document a breach at a provider<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The controller documents any personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken (Article 33(5)). According to the UODO guide documentation covers all breaches the controller has become aware of, regardless of the outcome of the risk assessment. The documentation may take the form of a breach register, although according to the guide a separate register is not mandatory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a breach at a provider it is worth recording the moment the message was received and the dates of the questions and answers. It is also worth attaching the reasoning behind the risk assessment and keeping all correspondence with the provider. If the controller waited for confirmation from the provider, the reason and length of the wait are worth recording. The documentation must enable the authority to verify compliance with Article 33, so it should also show the moment of becoming aware of the breach. According to the UODO guide the controller should also document an incident found not to be a breach, together with the reason for that decision.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What happens with the provider after the breach<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The controller uses only processors providing sufficient guarantees to implement appropriate technical and organisational measures (Article 28(1)). A breach at a provider is a reason to assess those guarantees again. The data processing agreement stipulates that the provider makes available all information necessary to demonstrate compliance with the obligations in Article 28 and allows for audits (Article 28(3)(h)). This includes information on the measures required pursuant to Article 32, which the provider takes in accordance with Article 28(3)(c).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is also worth checking whether the agreement sets a deadline in hours for notifying a breach and the scope of the first information. According to the EDPB the contract should specify how the requirements of Article 33(2) are to be met (paragraph 46). The provider&#8217;s side is described in <a href=\"https:\/\/www.lablogic.pl\/en\/processor-breach-notification-to-the-controller\/\">How and when must a processor notify a personal data breach to the controller?<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The controller&#8217;s steps after a breach at a provider<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The controller is responsible for all the steps in the table. For the steps under Articles 32 to 36 GDPR the provider assists within the scope of Article 28(3)(f). It also makes available the information necessary to demonstrate compliance with the obligations in Article 28 and allows for audits (point (h)).<\/p>\n\n\n\n<figure class=\"wp-block-table ll-art-table\"><table><thead><tr><th>Step<\/th><th>Basis<\/th><th>When<\/th><th>Exceptions and limits<\/th><\/tr><\/thead><tbody><tr><td>Confirmation whether the event covered the controller&#8217;s data<\/td><td>Article 28(3)(f) GDPR, announcement of the President of the UODO of 12 August 2026<\/td><td>immediately after the provider&#8217;s message<\/td><td>safer not to wait for confirmation before counting the deadline<\/td><\/tr><tr><td>Establishing the moment of becoming aware<\/td><td>Article 33(1) GDPR, EDPB Guidelines 9\/2022 paragraphs 31, 34 and 44<\/td><td>in principle the moment of the provider&#8217;s message<\/td><td>where the alert came from another source, a short investigation<\/td><\/tr><tr><td>Remedial action on the controller&#8217;s side<\/td><td>Article 33(3)(d) GDPR, UODO guide 6.1 and 7.1<\/td><td>immediately<\/td><td>regardless of the outcome of the risk assessment<\/td><\/tr><tr><td>Assessment of the risk to individuals<\/td><td>Article 33(1) and Article 34(1) GDPR, EDPB paragraphs 44 and 106 to 119<\/td><td>within 72 hours and again after new information from the provider<\/td><td>the provider&#8217;s assessment does not replace the controller&#8217;s<\/td><\/tr><tr><td>Classification of the incident (essential or important entity)<\/td><td>Article 11(1)(3), (4) and (4a) and (1a) and Article 8i(1) of the Polish KSC Act<\/td><td>immediately; early warning without delay and no later than 24 hours after detection; incident notification without delay and no later than 72 hours after detection, and for a controller that is a trust service provider 24 hours (Article 11(1a))<\/td><td>only an incident within the meaning of the Act; not in the banking and financial market infrastructure sectors<\/td><\/tr><tr><td>Notification to the President of the UODO<\/td><td>Article 33(1), (3) and (4) GDPR<\/td><td>without undue delay and, where feasible, within 72 hours; later with reasons for the delay<\/td><td>not where the risk is unlikely; a copy of the data held by the controller may change this in the case of loss or destruction of data, though not always; the EDPB illustrates this with encrypted data (paragraph 79); by the provider on behalf of the controller only with authorisation in the agreement, written according to the UODO guide<\/td><\/tr><tr><td>Communication to data subjects<\/td><td>Article 34 GDPR<\/td><td>without undue delay<\/td><td>only where the risk is high; exceptions in Article 34(3); by the provider on behalf of the controller only with authorisation in the agreement, written according to the UODO guide<\/td><\/tr><tr><td>Documentation of the breach<\/td><td>Article 33(5) GDPR, UODO guide 8.1<\/td><td>after becoming aware of the breach or deciding that there is none, and with each new piece of information<\/td><td>regardless of the outcome of the risk assessment; according to the UODO guide also an incident found not to be a breach; a register is not a mandatory form<\/td><\/tr><tr><td>Reassessment of the provider<\/td><td>Article 28(1) and (3)(h) GDPR<\/td><td>once the event is under control<\/td><td>scope of audit according to the agreement<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 id=\"wnioski\" class=\"wp-block-heading\">Conclusions and next steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The provider establishes whether a breach has occurred and notifies it to the controller without undue delay. The controller verifies the event and makes the final classification. It also assesses the risk, takes the decisions and is responsible for them.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Record the time of the provider&#8217;s message, check that it is genuine through the channel in the agreement and immediately ask for confirmation whether the event covered your data.<\/li>\n\n\n\n<li>Limit the effects on your own side at once and record each action with the time.<\/li>\n\n\n\n<li>Establish whether you hold a copy of the data and whom it concerns, then assess the risk within your own team.<\/li>\n\n\n\n<li>If you are an essential or important entity outside the banking and financial market infrastructure sectors, check whether the event is a significant incident. Submit the early warning of a significant incident to the competent sectoral CSIRT without delay and no later than 24 hours after detection. Submit the incident notification without delay and no later than 72 hours after detection, or within 24 hours as a trust service provider.<\/li>\n\n\n\n<li>Notify the breach to the President of the UODO without undue delay and, where feasible, within 72 hours. The exception is a breach that is unlikely to result in a risk to individuals. Supplement the information you do not yet have in phases. Name the person who will approve the notification at weekends too.<\/li>\n\n\n\n<li>Decide on communicating the breach to data subjects and agree with the provider who will send it and on whose behalf.<\/li>\n\n\n\n<li>Document the breach and plan a reassessment of the provider and a review of the data processing agreement.<\/li>\n<\/ol>\n\n\n\n<h2 id=\"materialy-powiazane\" class=\"wp-block-heading\">Related materials<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/processor-breach-notification-to-the-controller\/\"><strong>How and when must a processor notify a personal data breach to the controller?<\/strong><\/a> \u2014 the provider&#8217;s obligations and the terms of the agreement.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/how-to-count-72-hours-for-breach-notification\/\"><strong>How to count the 72 hours for notifying a personal data breach?<\/strong><\/a> \u2014 the moment of becoming aware and counting the deadline.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/does-every-data-breach-need-to-be-reported\/\"><strong>Does every data breach need to be reported?<\/strong><\/a> \u2014 the notification threshold and general rules of risk assessment.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/how-to-notify-data-subjects-of-a-breach\/\"><strong>How do you notify data subjects of a breach and what must the communication contain?<\/strong><\/a> \u2014 the content, channel and language of the communication.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/what-should-a-personal-data-breach-register-contain\/\"><strong>What should a personal data breach register contain?<\/strong><\/a> \u2014 the entry on a breach, including one that was not notified.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/data-processing-agreement\/\"><strong>What must a personal data processing agreement contain?<\/strong><\/a> \u2014 the terms on notifying breaches and on audits.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"zrodla\" class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-sources\">\n<li>Regulation (EU) 2016\/679 of the European Parliament and of the Council (GDPR), consolidated version \u2014 Article 26(1), Article 28(1), (3)(c), (f) and (h) and (4), Article 33 and Article 34 \u2014 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A02016R0679-20160504\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a>.<\/li>\n\n\n\n<li>Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 \u2014 Article 2(5), Article 8i(1) and Article 11(1)(3), (4) and (4a) and (1a) (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20180001560\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>European Data Protection Board, Guidelines 9\/2022 on personal data breach notification under GDPR, version 2.0 adopted on 28 March 2023 \u2014 paragraphs 31, 34, 36, 42, 44 to 48, 78, 79 and 106 to 119 \u2014 <a href=\"https:\/\/www.edpb.europa.eu\/documents\/guideline\/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en\" target=\"_blank\" rel=\"noreferrer noopener\">edpb.europa.eu<\/a>.<\/li>\n\n\n\n<li>Personal Data Protection Office (UODO), Guide on personal data breaches, version of 20 February 2025 \u2014 sections 5.2, 6.1, 7.1, 8.1, 9.2 and 10.2 (in Polish) \u2014 <a href=\"https:\/\/uodo.gov.pl\/pl\/598\/3563\" target=\"_blank\" rel=\"noreferrer noopener\">uodo.gov.pl<\/a>.<\/li>\n\n\n\n<li>Personal Data Protection Office (UODO), announcement \u201cThe controller must notify a leak that occurred at the processor\u201d of 12 August 2026 (in Polish) \u2014 <a href=\"https:\/\/uodo.gov.pl\/pl\/138\/4538\" target=\"_blank\" rel=\"noreferrer noopener\">uodo.gov.pl<\/a>.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-group ll-art-cta is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading ll-nietoc\">Let us agree what you will do after the provider&#8217;s message<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The order of steps and the division of roles with the provider are best agreed before the first message about a breach arrives. <a href=\"https:\/\/www.lablogic.pl\/en\/incident-response\/\">Incident consultation and an orderly response process<\/a> cover the assessment of a specific event at the provider and a procedure that the team handling breaches will use.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.lablogic.pl\/en\/incident-response\/\">Support with incidents and breaches<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The provider has written that a breach occurred in its systems. The 72-hour deadline in principle already runs for the controller, and the risk assessment, notification to the President of the UODO and communication to data subjects remain its responsibility.<\/p>\n","protected":false},"author":2,"featured_media":6368,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ll_stan_prawny":"November 2026","footnotes":""},"categories":[71],"tags":[],"class_list":["post-6369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incidents"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"A breach at a provider triggers the controller&#039;s obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Micha\u0142 Rutkowski\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"What must the controller do when a provider reports a data breach?\" \/>\n\t\t<meta property=\"og:description\" content=\"A breach at a provider triggers the controller&#039;s obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:section\" content=\"Incidents and Breaches\" \/>\n\t\t<meta property=\"article:tag\" content=\"breach at a provider\" \/>\n\t\t<meta property=\"article:tag\" content=\"processor data breach\" \/>\n\t\t<meta property=\"article:tag\" content=\"breach notification to the uodo\" \/>\n\t\t<meta property=\"article:tag\" content=\"72 hours to notify\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-14T12:36:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-14T14:26:46+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"What must the controller do when a provider reports a data breach?\" \/>\n\t\t<meta name=\"twitter:description\" content=\"A breach at a provider triggers the controller&#039;s obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#article\",\"name\":\"Breach at a provider \\u2013 what the controller must do\",\"headline\":\"What must the controller do when a provider reports a personal data breach?\",\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ll-og-naruszenie-u-dostawcy-en.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Breach at a provider \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"datePublished\":\"2026-11-14T13:36:00+01:00\",\"dateModified\":\"2026-11-14T15:26:46+01:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#webpage\"},\"articleSection\":\"Incidents and Breaches\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"position\":1,\"name\":\"LabLogic\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/incidents\\\/#listItem\",\"name\":\"Incidents and Breaches\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/incidents\\\/#listItem\",\"position\":2,\"name\":\"Incidents and Breaches\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/incidents\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#listItem\",\"name\":\"What must the controller do when a provider reports a personal data breach?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"name\":\"LabLogic\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#listItem\",\"position\":3,\"name\":\"What must the controller do when a provider reports a personal data breach?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/incidents\\\/#listItem\",\"name\":\"Incidents and Breaches\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\",\"name\":\"LabLogic\",\"description\":\"LabLogic is the advisory practice of Micha\\u0142 Rutkowski, based in Gdynia, Poland. It acts as an external data protection officer and supports NIS2 and Polish KSC Act implementation, incident and breach response, and AI Act readiness for medium and large organisations, on site in the Tricity area and remotely across Poland.\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"email\":\"m.rutkowski@lablogic.pl\",\"foundingDate\":\"2004\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/cropped-lablogic-site-icon-512.png\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#organizationLogo\",\"width\":512,\"height\":512},\"image\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"additionalType\":\"https:\\\/\\\/schema.org\\\/ProfessionalService\",\"legalName\":\"LabLogic Consulting Micha\\u0142 Rutkowski\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"ul. Wolno\\u015bci 15\",\"postalCode\":\"81-327\",\"addressLocality\":\"Gdynia\",\"addressRegion\":\"pomorskie\",\"addressCountry\":\"PL\"},\"vatID\":\"PL9580972114\",\"taxID\":\"9580972114\",\"areaServed\":{\"@type\":\"Country\",\"name\":\"Poland\"},\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"founder\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"hasOfferCatalog\":{\"@type\":\"OfferCatalog\",\"name\":\"Services\",\"itemListElement\":[{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"External Data Protection Officer (DPO)\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/external-dpo\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"NIS2 and KSC implementation support\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-ksc\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"Incident and data breach response\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"GDPR and NIS2 training\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/training\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"AI Act: roles, obligations and preparation\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/ai-act\\\/\"}}]}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/michal-rutkowski\\\/\",\"name\":\"Micha\\u0142 Rutkowski\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski-portret\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp\",\"width\":864,\"height\":1080,\"caption\":\"Micha\\u0142 Rutkowski\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"jobTitle\":\"Data Protection Officer (DPO), NIS2\\\/KSC and cybersecurity advisor\",\"description\":\"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.\",\"email\":\"m.rutkowski@lablogic.pl\",\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#webpage\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/\",\"name\":\"Breach at a provider \\u2013 what the controller must do\",\"description\":\"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ll-og-naruszenie-u-dostawcy-en.jpg\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Breach at a provider \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/breach-at-a-provider\\\/#mainImage\"},\"datePublished\":\"2026-11-14T13:36:00+01:00\",\"dateModified\":\"2026-11-14T15:26:46+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"name\":\"Micha\\u0142 Rutkowski - LabLogic\",\"alternateName\":\"LabLogic\",\"description\":\"DPO, GDPR, NIS2 and cybersecurity in practice\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Breach at a provider \u2013 what the controller must do","description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","canonical_url":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#article","name":"Breach at a provider \u2013 what the controller must do","headline":"What must the controller do when a provider reports a personal data breach?","author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg","width":1200,"height":630,"caption":"Breach at a provider \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"datePublished":"2026-11-14T13:36:00+01:00","dateModified":"2026-11-14T15:26:46+01:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#webpage"},"isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#webpage"},"articleSection":"Incidents and Breaches"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","position":1,"name":"LabLogic","item":"https:\/\/www.lablogic.pl\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/incidents\/#listItem","name":"Incidents and Breaches"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/incidents\/#listItem","position":2,"name":"Incidents and Breaches","item":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/incidents\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#listItem","name":"What must the controller do when a provider reports a personal data breach?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","name":"LabLogic"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#listItem","position":3,"name":"What must the controller do when a provider reports a personal data breach?","previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/incidents\/#listItem","name":"Incidents and Breaches"}}]},{"@type":"Organization","@id":"https:\/\/www.lablogic.pl\/#organization","name":"LabLogic","description":"LabLogic is the advisory practice of Micha\u0142 Rutkowski, based in Gdynia, Poland. It acts as an external data protection officer and supports NIS2 and Polish KSC Act implementation, incident and breach response, and AI Act readiness for medium and large organisations, on site in the Tricity area and remotely across Poland.","url":"https:\/\/www.lablogic.pl\/en\/","email":"m.rutkowski@lablogic.pl","foundingDate":"2004","logo":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/cropped-lablogic-site-icon-512.png","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#organizationLogo","width":512,"height":512},"image":{"@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#organizationLogo"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"additionalType":"https:\/\/schema.org\/ProfessionalService","legalName":"LabLogic Consulting Micha\u0142 Rutkowski","address":{"@type":"PostalAddress","streetAddress":"ul. Wolno\u015bci 15","postalCode":"81-327","addressLocality":"Gdynia","addressRegion":"pomorskie","addressCountry":"PL"},"vatID":"PL9580972114","taxID":"9580972114","areaServed":{"@type":"Country","name":"Poland"},"knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"founder":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"hasOfferCatalog":{"@type":"OfferCatalog","name":"Services","itemListElement":[{"@type":"Offer","itemOffered":{"@type":"Service","name":"External Data Protection Officer (DPO)","url":"https:\/\/www.lablogic.pl\/en\/external-dpo\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"NIS2 and KSC implementation support","url":"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Incident and data breach response","url":"https:\/\/www.lablogic.pl\/en\/incident-response\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"GDPR and NIS2 training","url":"https:\/\/www.lablogic.pl\/en\/training\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"AI Act: roles, obligations and preparation","url":"https:\/\/www.lablogic.pl\/en\/ai-act\/"}}]}},{"@type":"Person","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski","url":"https:\/\/www.lablogic.pl\/michal-rutkowski\/","name":"Micha\u0142 Rutkowski","image":{"@type":"ImageObject","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski-portret","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp","width":864,"height":1080,"caption":"Micha\u0142 Rutkowski"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"jobTitle":"Data Protection Officer (DPO), NIS2\/KSC and cybersecurity advisor","description":"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.","email":"m.rutkowski@lablogic.pl","knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"worksFor":{"@id":"https:\/\/www.lablogic.pl\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#webpage","url":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/","name":"Breach at a provider \u2013 what the controller must do","description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#breadcrumblist"},"author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"creator":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg","@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#mainImage","width":1200,"height":630,"caption":"Breach at a provider \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"primaryImageOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/#mainImage"},"datePublished":"2026-11-14T13:36:00+01:00","dateModified":"2026-11-14T15:26:46+01:00"},{"@type":"WebSite","@id":"https:\/\/www.lablogic.pl\/en\/#website","url":"https:\/\/www.lablogic.pl\/en\/","name":"Micha\u0142 Rutkowski - LabLogic","alternateName":"LabLogic","description":"DPO, GDPR, NIS2 and cybersecurity in practice","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"}}]},"og:locale":"en_US","og:site_name":"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice","og:type":"article","og:title":"What must the controller do when a provider reports a data breach?","og:description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","og:url":"https:\/\/www.lablogic.pl\/en\/breach-at-a-provider\/","og:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg","og:image:secure_url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg","og:image:width":1200,"og:image:height":630,"article:section":"Incidents and Breaches","article:tag":["breach at a provider","processor data breach","breach notification to the uodo","72 hours to notify"],"article:published_time":"2026-11-14T12:36:00+00:00","article:modified_time":"2026-11-14T14:26:46+00:00","twitter:card":"summary_large_image","twitter:title":"What must the controller do when a provider reports a data breach?","twitter:description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","twitter:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg"},"aioseo_meta_data":{"post_id":"6369","title":"Breach at a provider \u2013 what the controller must do","description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","keywords":null,"keyphrases":{"focus":{"keyphrase":"breach at a provider","score":0},"additional":[{"keyphrase":"processor data breach","score":0},{"keyphrase":"breach notification to the UODO","score":0},{"keyphrase":"72 hours to notify","score":0},{"keyphrase":"data breach risk assessment","score":0},{"keyphrase":"data processing agreement","score":0}]},"primary_term":null,"canonical_url":null,"og_title":"What must the controller do when a provider reports a data breach?","og_description":"A breach at a provider triggers the controller's obligations. When the 72 hours start, what to assess yourself, who notifies the UODO and what to document.","og_object_type":"article","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Incidents and Breaches","og_article_tags":[{"label":"breach at a provider","value":"breach at a provider"},{"label":"processor data breach","value":"processor data breach"},{"label":"breach notification to the UODO","value":"breach notification to the UODO"},{"label":"72 hours to notify","value":"72 hours to notify"}],"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-11-14 12:43:14","updated":"2026-11-14 14:26:54","seo_analyzer_scan_date":null,"focus_keyword":"breach at a provider","additional_keywords":[{"word":"processor data breach","score":0},{"word":"breach notification to the UODO","score":0},{"word":"72 hours to notify","score":0},{"word":"data breach risk assessment","score":0},{"word":"data processing agreement","score":0}],"truseo_locale":null},"spectra_blocks_featured_image_url":{"thumbnail":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en-150x150.jpg","width":150,"height":150},"medium":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en-300x158.jpg","width":300,"height":158},"medium_large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en-768x403.jpg","width":768,"height":403},"large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en-1024x538.jpg","width":1024,"height":538},"full":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/11\/ll-og-naruszenie-u-dostawcy-en.jpg","width":1200,"height":630}},"spectra_blocks_author_info":{"display_name":"Micha\u0142 Rutkowski","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g","author_link":"https:\/\/www.lablogic.pl\/en\/author\/michal-rutkowski\/","description":"Micha\u0142 Rutkowski \u2014 praktyk ochrony danych i cyberbezpiecze\u0144stwa, w\u0142a\u015bciciel LabLogic. Od 2004 roku pracuje na styku technologii, ochrony danych i zarz\u0105dzania ryzykiem. Pe\u0142ni funkcj\u0119 zewn\u0119trznego IOD\/DPO, prowadzi audyty RODO, kwalifikacj\u0119 i wdro\u017cenia NIS2 oraz ustawy o KSC, wspiera organizacje przy incydentach i naruszeniach ochrony danych, szkoli zarz\u0105dy, kadr\u0119 kierownicz\u0105 oraz zespo\u0142y IT i compliance. Pracuje ze \u015brednimi i du\u017cymi organizacjami, w tym z sektora finansowego i bran\u017c regulowanych."},"_links":{"self":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/comments?post=6369"}],"version-history":[{"count":3,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6369\/revisions"}],"predecessor-version":[{"id":6397,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6369\/revisions\/6397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media\/6368"}],"wp:attachment":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media?parent=6369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/categories?post=6369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/tags?post=6369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}