When a Supplier Has a Breach

Their incident becomes your obligation, on your clock, with information you do not control.

Suppliers · Procedure

72 hoursfrom your awareness, which begins when they tell youTheir delay consumes your window

SUPPLIER BREACH RESPONSE

Opened the moment they notify you

They told us
Date and timeYour clock starts here
They became aware
Date and timeThe gap is a contract matter and a finding
What they say happened
Their account, recorded verbatimIt will change
Our data involved
Which categories, how many of our peopleAsk specifically. Their first account is general
Who is controller
Us, for our staff dataWhich means notification is our obligation
Our assessment
Risk to our people, not to themSeparate from their assessment
Notification
Our decision, on our reasoningWe cannot rely on theirs
Telling our staff
If high risk, from us, not from themPeople hear from their employer

A supplier reports an incident. The data is yours, the people are your staff, and the obligation to notify is yours.

The breach workflow in “When a Supplier Has a Breach” is easier to operate when systems, owners and evidence are known in advance. If this product guide supports remote employee productivity monitoring, its records should sit inside the incident inventory with clear access, retention and escalation rules rather than being treated as an unexplained source of employee data.

The clock

Your window begins when you become aware, which is when they tell you.

For a separate benchmark relevant to “When a Supplier Has a Breach”, consult the Microsoft data-loss-prevention documentation. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.

Which means their delay comes directly out of your window. A supplier that takes four days to notify has left you nothing, and that is the reason the contract should specify a period in hours rather than without undue delay.

Where they were slow, record the gap. It is a contractual matter and it belongs in the file.

You are the controller

For your staff data, you decide purposes and you are answerable.

Their assessment of risk is about their customers in general. Yours must be about your people specifically: what of theirs was involved, how many, and what could happen to them.

You cannot adopt their conclusion. You can use their facts.

Getting the facts

Their first account is general and incomplete. Ask specifically:

Which of our records. How many of our people. Which categories, including whether special category data was involved. Is it contained. Who has the data now.

Written answers, recorded, because the account will change over the following days and you will need to show what you knew when.

Notifying

If the threshold is met, you notify the regulator about your people. The supplier notifies about theirs, and may notify about yours too — which does not discharge your obligation.

Co-ordinating avoids the people affected hearing twice or hearing different things.

Telling your staff

From you, not from the supplier.

An employee learning from a third party that their employer's payroll provider lost their bank details has learned two things, and the second is about the employer.

Afterwards

What changed at the supplier, and whether you accept it.

A breach is also information about the supplier assessment you did. If the answer is that nothing changed, that is a finding for the next renewal.

Getting facts rather than reassurance

Which of our records, how many of our people, which categories, is it contained, who has it now. Written answers, recorded, because the account will change and you will need to show what you knew when.

Their assessment is not yours

Theirs is about their customers generally. Yours must be about your people specifically, and you cannot adopt their conclusion even where you use their facts.

Their delay is your problem

Your clock starts when they tell you, which means a four-day delay leaves you nothing. Record the gap: it is a contract matter and it belongs in the file.

Telling your own staff

From you, not from the supplier. An employee learning from a third party that your payroll provider lost their bank details has learned two things, and the second is about you.

Afterwards, as information

What changed at the supplier and whether you accept it. A breach is also information about the diligence you did, and if nothing changed that is a finding for the next renewal.

Coordinating the notifications

The supplier may notify about your people too, which does not discharge your obligation. Coordinating avoids the affected people hearing twice or hearing different accounts.

Also in this section