Breach Notification and Your Vendors: What They Owe You and What to Put in Contracts

When a data breach occurs at one of your vendors, the clock starts ticking immediately — on regulatory notification deadlines, forensic investigation windows, and reputational damage control. Yet many organizations discover that their vendor contracts contain vague or nonexistent breach notification requirements. The result: delayed disclosure, compounded damage, and regulatory exposure for both parties. Understanding what regulations require and what your contracts should specify is a critical component of any third-party risk management program.

The Regulatory Landscape for Breach Notification

SEC Cybersecurity Disclosure Rules (Effective December 2023)

The U.S. Securities and Exchange Commission's final rule on cybersecurity risk management, strategy, governance, and incident disclosure took effect on December 18, 2023 for large filers. The rule requires public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining that an incident is material. Critically, this applies regardless of whether the incident originated at the company or at a third-party vendor. If a vendor breach is material to your organization, you must disclose it — which means you need to know about it promptly.

GDPR Article 33: 72-Hour Notification

Under the EU General Data Protection Regulation, data controllers must notify their supervisory authority within 72 hours of becoming aware of a personal data breach. When a data processor (vendor) experiences a breach involving your data, Article 33(2) requires the processor to notify the controller "without undue delay" after becoming aware of the breach. This creates a cascading timeline: your vendor must tell you quickly enough that you can meet your own 72-hour obligation to regulators.

HIPAA Breach Notification Rule

Under HIPAA, business associates (vendors handling protected health information) must notify covered entities of a breach of unsecured PHI "without unreasonable delay" and no later than 60 days after discovery. The covered entity must then notify affected individuals within 60 days. For breaches affecting 500 or more individuals, the covered entity must also notify the HHS Secretary and prominent media outlets. Delayed vendor notification directly compresses the covered entity's response window.

What to Include in Vendor Contracts

Regulatory frameworks establish minimum requirements, but contracts are where you define specific vendor obligations. The following clauses should be standard in any agreement with a vendor that handles sensitive data:

• Notification timeline: Specify a maximum time for the vendor to notify you after discovering a breach — 24 to 48 hours is the current best practice, with 72 hours as an outer bound to align with GDPR. Vague language like "promptly" or "as soon as practicable" is insufficient and leads to disputes.
• Scope of notification: Define what information the vendor must include in their initial notification: nature of the incident, data types affected, estimated number of records involved, initial timeline of the breach, and remediation steps being taken.
• Cooperation clauses: Require the vendor to cooperate fully with your incident response team, including providing regular status updates, participating in joint incident response calls, and coordinating on public communications.
• Forensic access: Reserve the right to conduct or commission independent forensic investigation of the vendor's systems following a breach. This is essential when the vendor's own assessment may be incomplete or self-serving.
• Indemnification: Include indemnification provisions covering regulatory fines, legal fees, notification costs, and credit monitoring expenses resulting from a breach originating at the vendor. Negotiate mutual caps carefully.
• Evidence preservation: Require the vendor to preserve all relevant logs, records, and forensic evidence for a defined period following a breach. This supports both investigation and potential litigation.

When Delayed Notification Made Things Worse

SolarWinds: Nine Months Undetected

The SolarWinds supply chain compromise, discovered in December 2020, had been active since at least March 2020 — meaning the attackers had access to victim networks for approximately nine months before detection. During that time, an estimated 18,000 organizations installed the compromised Orion software update. The extended dwell time allowed the threat actors, attributed to Russia's SVR intelligence service, to conduct extensive espionage across U.S. government agencies and private sector companies. While SolarWinds itself was the compromised vendor, the incident highlighted how supply chain attacks can persist undetected for months when monitoring and notification mechanisms are inadequate.

Blackbaud: Delayed Disclosure to Customers

In May 2020, cloud computing provider Blackbaud experienced a ransomware attack that affected data held on behalf of thousands of nonprofit organizations, healthcare entities, and educational institutions. Blackbaud did not notify affected customers until July 2020, approximately two months after the incident. Furthermore, Blackbaud initially stated that no sensitive data was compromised, only to later reveal that bank account numbers, Social Security numbers, and login credentials were in fact affected. The SEC charged Blackbaud with making materially misleading disclosures about the breach. In March 2023, Blackbaud agreed to pay $3 million to settle the SEC charges. The FTC also took action, and Blackbaud reached a $49.5 million settlement with attorneys general from 49 states and the District of Columbia in 2024.

Building Notification Requirements into Your TPRM Program

Effective breach notification management is not just a legal exercise — it is a core TPRM function. Organizations should maintain a centralized inventory of all vendor contracts with breach notification provisions, track notification timelines and obligations by vendor tier, include breach notification requirements in vendor assessment questionnaires, and conduct tabletop exercises that simulate a vendor breach notification scenario to test response processes.

TPRM platforms like Fair TPRM enable organizations to track vendor contractual obligations alongside security assessments and compliance status, creating a single source of truth for vendor risk management that includes notification requirements as a first-class concern.