{"id":4938,"date":"2026-11-06T12:47:25","date_gmt":"2026-11-06T12:47:25","guid":{"rendered":"https:\/\/sawaryn.com\/?p=4938"},"modified":"2026-11-06T12:49:10","modified_gmt":"2026-11-06T12:49:10","slug":"saas-provider-data-breach-72-hour-response","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/saas-provider-data-breach-72-hour-response\/","title":{"rendered":"Data Leak at a SaaS Provider: What You Must Do Within 72 Hours, Even Though You Were Not Attacked"},"content":{"rendered":"

On Friday afternoon, you receive a forwarded message from a client: your invoicing application provider has been attacked, and its database has ended up on third-party servers. Your systems are untouched. The provider has already reported the breach to the UODO, notified CERT Polska and the Police. It may seem that the matter does not concern you.<\/p>\n

It does \u2014 and you have 72 hours<\/strong> to deal with it, starting from the moment you read that email.<\/p>\n

The provider\u2019s notification covers only the data for which it is the controller \u2014 the service\u2019s user accounts. The details of your business partners in the records, invoice contents, addresses, amounts and bank account numbers have a different controller. You. And it is you who is responsible for reporting the breach to the UODO<\/a> pursuant to Article 33(1) GDPR<\/strong>.<\/p>\n

This article provides a structured course of action: from determining when the deadline starts running, through securing the account, identifying the individuals affected and assessing the risk, to submitting the notification and communicating with business partners. It is all based on an anonymised, real-life incident with a D \/ D+1 timeline.<\/p>\n

Key concepts before you take action<\/h2>\n

Before moving on to the specific steps, make sure you understand the terminology. There is no time to look up definitions during an incident.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means in the context of a data leak<\/th>\n<\/tr>\n<\/thead>\n
Controller<\/strong><\/td>\nThe entity that determines the purposes and means of processing personal data. If you use a SaaS invoicing application, you are the controller of your business partners\u2019 data \u2014 not the application provider.<\/td>\n<\/tr>\n
Processor<\/strong><\/td>\nAn entity that processes data on your behalf \u2014 in this case, the SaaS provider. It processes the data under a data processing agreement<\/a>.<\/td>\n<\/tr>\n
Personal data breach<\/strong><\/td>\nAn incident resulting in the unauthorised disclosure, loss or destruction of personal data (Article 4(12) GDPR). A database leak at your provider constitutes a breach for you as the controller.<\/td>\n<\/tr>\n
Initial notification<\/strong><\/td>\nA notification submitted within the 72-hour deadline using approximate figures and marking information as \u201cunder investigation” \u2014 Article 33(4) GDPR permits information to be provided in phases.<\/td>\n<\/tr>\n
Supplementary notification<\/strong><\/td>\nAdditional information provided after obtaining details from the provider \u2014 submitted using the same form on biznes.gov.pl.<\/td>\n<\/tr>\n
Breach register<\/strong><\/td>\nInternal documentation required under Article 33(5) GDPR \u2014 it must be maintained even if the controller determines that notification is not required.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why your provider\u2019s notification does not protect you<\/h2>\n

This is the most common mistake after receiving information about a breach at a processor. The management board sees the provider\u2019s announcement: \u201cwe have reported the breach to the UODO and notified CERT Polska and the Police” \u2014 and assumes the matter is closed.<\/p>\n

It is not. And this follows directly from the legislation.<\/p>\n

Article 33(1) GDPR<\/strong> places the obligation to notify the supervisory authority of a breach on the controller<\/strong>. Article 33(2) requires the processor to notify the controller \u2014 not the authority. These are two separate obligations imposed on two different entities and addressed to different recipients.<\/p>\n

The SaaS provider reported the breach as the controller of its own data \u2014 the service\u2019s user accounts. Your business partners\u2019 details in the records, the amounts on invoices, addresses and bank account numbers are data for which you are the controller. The provider did not report them on your behalf because it could not do so.<\/p>\n

The UODO imposes fines for late or omitted notifications. Confirmed fines have been imposed on both small entities (PLN 5,000 \u2014 UODO decision DKN.5131.30.2022<\/a>) and financial institutions (over PLN 350,000 \u2014 Bank Millennium, decision upheld by the Supreme Administrative Court). The amount depends on the criteria set out in Article 83(2) GDPR: the nature of the breach, intent and cooperation with the authority.<\/p>\n

A mass notification sent by the provider to your address as a user of the service does not fulfil its obligation under Article 33(2) towards you as the controller. It is a marketing communication, not a formal notification from the processor addressed to the data controller.<\/p>\n

Contact us<\/a> if you need assistance assessing whether your notification obligation has already arisen.<\/p>\n