When a supplier is breached, the customer may still have to answer the hardest question: what data did the supplier hold on its behalf? In a first-person account, Serguey Shinder describes how gaps in his organization’s supplier records delayed its understanding of its own exposure. The lesson is practical: document the data, retention, subprocessors and processing locations before an incident forces you to find out.
Why a supplier breach can become your unanswered question
Serguey Shinder’s account begins with a supplier telling his organization that its environment had been accessed. The supplier had the immediate incident, but the customer had to establish what of its own information might be involved. Shinder writes, “Only one question mattered after that, which was what of ours they held.”
As an Amazon Associate I earn from qualifying purchases.
He says his organization took twelve days to determine what data the supplier held. That is a detail from one author’s account, not a verified industry statistic; the article’s publication year and jurisdiction are not established in the available article result. The account nevertheless illustrates a common operational dependency: a customer cannot assess its exposure well if it has not recorded what it sent to a supplier in the first place. Read Shinder’s account on DEV Community.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the supplier register recorded—and what it missed
Shinder reports that his organization’s register contained 214 supplier entries, with fields for contract value, an owner, renewal date, service description and whether an assurance questionnaire was on file. It did not record the data each supplier processed, its approximate volume, how long the supplier retained it or where it was processed.
#1 Best Overall
That distinction matters. Commercial oversight can identify who provides a service and when a contract renews, but it may not tell responders which people or records could be affected when the provider reports an incident. Shinder’s account describes an initial contract referring to “claim documentation”; in practice, operational staff attached scanned identity documents through a general portal field. He says the contracted retention period was two years, while the supplier reportedly held the data for nine. A subprocessor appeared only in an annex.
Build an inventory around exposure, not just procurement
A useful supplier record should help answer incident questions quickly. Shinder says his organization later added data categories, approximate volume, retention, subprocessors and processing locations, then reviewed suppliers in order of sensitivity. These are practical inventory questions, not an exact universal statutory field list established by the UK guidance cited below.
- Data: What personal or other sensitive information does the supplier receive or generate, and which categories of people does it concern?
- Scale: What is the approximate volume, and how is that estimate kept current?
- Retention and deletion: How long is each data set kept, what happens at service end, and what evidence confirms return or deletion?
- Access chain: Which subprocessors can access or process the information, and how will changes be communicated?
- Location: Where is data processed or stored, including through subprocessors?
- Incident coordination: How quickly must the supplier report a suspected or confirmed breach, through which channel, and to which named contacts?
- Evidence and access: What incident information, audit evidence or inspection rights can the customer obtain?
Make these questions part of procurement and contract review before signature, then revisit them when the service, data, subprocessor chain or retention practice changes. A description such as “claims support” or “customer portal” is not a substitute for documenting the information that actually flows through the service.
Free tools Windows power users keep installed
One-click scans. No signup required.
What UK GDPR guidance says about breach duties
The article does not identify its jurisdiction, so its account should not be treated as a statement of any particular law. The following points describe UK ICO guidance for processing covered by the UK GDPR, not a universal deadline or legal advice for an unidentified incident.
Rank #3
- A processor must notify the controller without undue delay after becoming aware of a personal data breach. ICO processor guidance.
- A controller must notify the ICO without undue delay and, where the breach is notifiable, no later than 72 hours after becoming aware. Notification is not required where the breach is unlikely to result in a risk to people’s rights and freedoms, but the controller should be able to justify and document that decision. ICO personal data breach guide.
- For processor contracts, ICO guidance says the agreement should identify the subject matter and duration of processing, its nature and purpose, the types of personal data and categories of data subjects. It must also cover documented instructions, confidentiality, security, authorised subprocessors under written contracts, assistance with breach obligations, data return or deletion at contract end, and audit or inspection. ICO contracts guidance.
- For third-party breach arrangements, the ICO recommends specifying reporting timescales, communication channels and nominated contacts. ICO third-party arrangements guidance.
The ICO says its third-party arrangements guidance is under review following the Data (Use and Access) Act. Check current regulator guidance and the law that applies to your organization before relying on it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rehearse the questions you cannot answer from your own systems
A customer may not have direct logs or forensic access to a supplier’s environment. Shinder’s practical recommendation is to rehearse a breach scenario in which that access is unavailable. The point is to find out whether the organization can identify its data exposure and coordinate decisions using its own records and the supplier’s agreed incident process.
- Start with a supplier alert. Ask the response team to identify the affected service, data categories and people from the supplier inventory.
- Test the information request. Confirm who contacts the supplier, what details are needed, how quickly they are expected, and how updates will be delivered.
- Check internal ownership. Establish who assesses impact, brings in privacy or legal expertise, and decides what notifications are required under the applicable law.
- Find stale records. Verify that completed services do not leave data behind and that retention and deletion commitments have evidence behind them.
- Record the gaps. Turn missing data, unclear contacts or unworkable reporting expectations into specific inventory, contract or response-plan changes.
Shinder says the review work took a contractor four months and found six suppliers retaining data after services had ended, including one that had held it since 2021. Those are figures from his individual account, not evidence of how prevalent such failures are. The account’s warning is sharper for being concrete: a service can end while its data remains.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
