How much time does a processor have to notify the controller of a personal data breach?

ANSWER

The processor is obliged to notify the controller of a personal data breach without undue delay after becoming aware of the breach — Article 33(2) GDPR. The GDPR does not provide for any maximum (indicative) deadline for the processor, nor any sanctions for failing to meet such a deadline. However, it should be noted that a breach of Article 33 GDPR — including by a processor — constitutes grounds for imposing an administrative fine on the controller under Article 83(4)(a) GDPR. Therefore, the controller should specify in the data processing agreement the time within which the processor must notify the controller of a breach, while complying with the "without undue delay" requirement set out in Article 33(2).