#Breach Notification Commitment: GDPR (EU/EEA)

DIS-EU-016 v1.0.0, Last Modified On 01 August 2026, Tier: Public

---

#Applicability

---

#1. What this varies, and what it does not

This statement varies the global commitment DIS-GL-016 for an EEA hospital. It does not change the severity model, the incident response process, the rehearsal cadence or the escalation contacts. Those are in DIS-GL-016 and POL-GL-112 and are not restated. What is forked here is the clock map: which statutory clocks an EEA hospital is running, who reports to whom, and how Pensieve Labs's commitment is positioned inside them.

The contractual expression is DPA-EU-001 clause 9 and MSA-EU-001 clause 5.2.

---

#2. The commitment

"Aware" means the point at which any Pensieve Labs person or system holds information indicating an incident may have occurred. It does not mean confirmed, triaged, scoped or understood. A clock that starts at certainty can be started whenever it is convenient.

---

#3. The clocks an EEA hospital is actually running

An incident at a European hospital starts up to four clocks in parallel, and they do not have the same start point. This is the single most common source of confusion in a European security review, and getting it wrong in a contract costs the hospital its own deadline.

flowchart LR
  T0["T0: Pensieve Labs becomes aware"] --> P["≤ 4 hours<br/>Pensieve Labs notifies the hospital<br/>with reportable content"]
  P --> A["≤ 24 hours from the hospital's awareness<br/>Hospital files NIS2 early warning<br/>with the national CSIRT"]
  P --> B["≤ 72 hours from the hospital's awareness<br/>Hospital notifies the supervisory authority<br/>under GDPR Art. 33"]
  P --> C["≤ 72 hours from the hospital's awareness<br/>Hospital files the NIS2 incident notification"]
  P --> D["Without undue delay<br/>Hospital communicates to data subjects<br/>under GDPR Art. 34, where the risk is high"]
  C --> E["≤ 1 month<br/>Hospital files the NIS2 final report"]

Text description. At time zero Pensieve Labs becomes aware of an incident. Within four hours it notifies the hospital with content sufficient for the hospital's own filings. That notification feeds four hospital obligations running in parallel: a NIS2 early warning to the national computer security incident response team within 24 hours; a GDPR Article 33 notification to the supervisory authority within 72 hours; a NIS2 incident notification within 72 hours; and, where the risk to individuals is high, an Article 34 communication to affected data subjects without undue delay. A NIS2 final report follows within one month.

Note the asymmetry. Clocks 1 to 5 run from the hospital's awareness, not Pensieve Labs's. The four-hour commitment exists to make the hospital's awareness follow Pensieve Labs's as closely as possible, so that the hospital is not spending its own 24-hour window waiting for a vendor.

Clocks 1, 3 and 5 apply only where the hospital is a covered entity under its national transposition. Hospitals are ordinarily essential entities in the health sector. Where the transposition is not yet in force in the hospital's State, clocks 1, 3 and 5 do not run; clocks 0, 2 and 4 always do. The country delta packs record the position.

---

#4. Who reports: the boundary, stated affirmatively

The hospital reports. Pensieve Labs does not.

In all four deployment models the hospital is the controller and holds the Article 33 obligation. Edsol Edtech Pvt. Ltd. is the processor: its statutory duty is Article 33(2), to notify the controller without undue delay, and it discharges that duty at four hours. It supplies content, technical analysis and evidence.

Edsol Edtech Pvt. Ltd. does not notify a supervisory authority or a data subject on the hospital's behalf, does not represent that it can, and will not agree a contract term that says it will. A processor that files on a controller's behalf creates a record the controller cannot stand behind.

Edsol Edtech Pvt. Ltd. is not itself a covered entity under any national transposition of Directive (EU) 2022/2555 and holds no registration under one. Its obligations under this statement are contractual. STM-EU-002 states the position in full.

---

#5. What the first notification contains

Written so the hospital's data protection officer can lift it into the supervisory authority's own form.

Where a field is unknown, the notification says so and states when it will be supplied. It does not omit the field, because an omitted field looks like a nil return.

---

#6. Phased reporting: mapping Pensieve Labs's outputs to the hospital's filings

---

#7. Per-model responsibilities

DM-4 is the model where a breach commitment is most often over-promised by vendors. Pensieve Labs will not commit to detecting an incident on hardware it cannot see.

---

#8. Sub-processor incidents

An incident at a sub-processor is an incident for the purposes of this statement, and the four-hour clock runs from Pensieve Labs's awareness. Edsol Edtech Pvt. Ltd. remains fully liable to the hospital for its sub-processors' performance under DPA-EU-001 clause 7.7. The sub-processor's identity, role and country are already published in DIS-GL-009, so the hospital does not learn of a sub-processor's existence for the first time in a breach notification.

---

#9. Limitations

9.1 Four hours is a notification commitment, not a containment commitment. Containment time depends on the incident. SLA-GL-001 states the response times; nothing here promises a resolution time.

9.2 The first notification will be incomplete. That is deliberate. A vendor that waits for a complete picture before notifying has spent the hospital's 24-hour window on its own comfort.

9.3 Not every incident is a personal data breach. A failed intrusion attempt, a denial-of-service event with no data impact, or a vulnerability disclosure are security incidents but may not be Article 4(12) breaches. Pensieve Labs notifies security incidents affecting the hospital's environment under SLA-GL-001 and applies the four-hour clock where a personal data breach cannot be excluded. Where it is uncertain, Pensieve Labs notifies.

9.4 The significance test is the hospital's. Whether an incident is "significant" under the hospital's NIS2 transposition, and whether the Article 34 risk threshold is met, are assessments the hospital makes. Pensieve Labs supplies the facts and its own view; it does not make the call.

9.5 No admission. A notification is not an admission of fault or liability.

9.6 Language. Notifications are issued in English. Pensieve Labs does not undertake to file in the hospital's national language, because the hospital files, not Pensieve Labs.

---

#10. How to reach Pensieve Labs about an incident

A hospital should test the security channel during evaluation by sending a test message and timing the acknowledgement. Pensieve Labs expects to be tested.

---

#11. Related documents

---

#12. Change history