Glean uses security measures to protect your data and will notify your employer if there is a data breach, but your employer — not Glean — is responsible for notifying you directly.
If Glean suffers a data breach affecting your workplace data, you will only be notified if your employer chooses to pass on Glean's breach notification — Glean has no direct obligation to notify individual employees.
Cross-platform context
See how other platforms handle Security Measures and Breach Notification and similar clauses.
Compare across platforms →Employees may not receive timely breach notifications because Glean notifies only the employer-controller, creating a chain of communication that could delay individual notification beyond statutory deadlines.
REGULATORY FRAMEWORK: GDPR Article 33 requires processor-to-controller breach notification within 72 hours; Article 34 requires controller-to-individual notification where breach is likely to result in high risk. The employer-controller bears the Article 34 obligation. CCPA/CPRA §1798.150 creates a private right of action for California residents for certain data breaches involving unencrypted personal information. US state breach notification laws (all 50 states have enacted statutes) impose varying timelines and scope requirements on controllers. HIPAA 45 CFR 164.400–414 applies if PHI is involved.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.