Data processing — Breaches & assessments

Personal Data Breach. We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and in any event within 72 hours. The notice will describe, so far as we know it at the time: the nature of the breach and the categories and approximate number of data subjects and records involved; the likely consequences; and the measures taken or proposed. We will supplement it as we learn more, and we will not delay an initial notification to send a complete one. The 72 hours is measured from our awareness, not yours, and it is set there because your own obligation under Article 33 runs to 72 hours from your awareness — a slower processor commitment would consume the whole of your window before you knew there was one. Assessments. We will give you reasonable assistance with data protection impact assessments and any prior consultation with a Supervisory Authority, to the extent the processing relates to the Service and the information is not otherwise available to you — in practice, the security, compliance and privacy pages answer most of what an assessment asks, and we will complete a questionnaire where they do not.