GDPR · apply · about 10 minutes

A support inbox exported to the wrong place

Friday, 17:40. An engineer discovers that a nightly job has been copying the support ticket archive — names, emails, free-text messages, some of which mention health conditions — into a publicly readable cloud bucket. The job has run for eleven nights. Access logs exist but have not been read yet. The COO asks you what happens now.

Write what you would send the COO before you go home. Six lines, decisions first.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Starts the 72-hour clock from now, Friday 17:40, not from when forensics finish 72 hours, from awareness
Separates the two decisions: notify the authority (risk) and tell the individuals (high risk) Two thresholds, two audiences
Flags the health mentions as special-category data, which raises the risk assessment When a DPIA is mandatory
Says the breach gets logged with the reasoning whatever is decided Log every breach, including the ones you do not report
Names who notifies: the controller, even if the bucket belongs to a processor The processor has duties of its own
Does not promise certainty it does not have — notification in phases is allowed 72 hours, from awareness

Read against Regulation (EU) 2016/679 (GDPR), Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.