Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The DPA states that Modal will notify Customer within 48 hours of becoming aware of a data breach affecting Customer Personal Data, providing information sufficient for Customer to meet its own reporting and data subject notification obligations under applicable privacy laws.
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a processor-to-controller breach notification timeline of 48 hours, which is shorter than the GDPR's 72-hour controller-to-supervisory-authority window, providing Customer additional time to assess the breach and prepare regulatory notifications. The provision places the obligation to notify data subjects and supervisory authorities on Customer rather than Modal, consistent with the processor-controller relationship.
Under this clause, Modal is contractually required to notify Customer within 48 hours of detecting a data breach involving Customer Personal Data. The agreement requires Modal to provide sufficient information for Customer to fulfill its own regulatory notification obligations, but the responsibility for notifying supervisory authorities and data subjects rests with Customer as controller.
Cross-platform context
See how other platforms handle 48-Hour Data Breach Notification and similar clauses.
Compare across platforms →Monitoring
Modal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Processor shall notify Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Applicable Privacy Laws.Excerpt from Modal's Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 33 (notification to supervisory authority within 72 hours) and Article 34 (communication to data subjects), as well as equivalent provisions under UK GDPR and US state breach notification laws. The 48-hour processor-to-controller window is more specific than the GDPR's 'without undue delay' standard for processors under Article 33(2), which does not specify a timeframe. US state breach notification laws impose varying timelines and notification requirements on controllers that Customer must satisfy following receipt of Modal's notification. (2) GOVERNANCE EXPOSURE: Medium. The 48-hour notification window provides Customer with a compressed timeframe to assess breach severity, determine regulatory notification obligations, and prepare communications, particularly where the breach spans multiple jurisdictions with different notification deadlines. Customers in EU, UK, and US regulated industries should ensure their incident response procedures are calibrated to act within this window. (3) JURISDICTION FLAGS: EU Customers must notify their lead supervisory authority within 72 hours of becoming aware of a breach, meaning the 48-hour modal notification window leaves approximately 24 hours for Customer assessment and notification preparation. UK Customers face a 72-hour window to the ICO. US state notification laws vary by state and data type, with some imposing 30-72 hour windows. Healthcare Customers subject to HIPAA face a 60-day notification window to HHS OCR for business associate breaches. (4) CONTRACT AND VENDOR IMPLICATIONS: Customer incident response plans should incorporate the 48-hour notification trigger and define internal escalation, assessment, and notification workflows that can be completed within the relevant regulatory windows following receipt of Modal's notification. The DPA requires Modal to cooperate in investigation and remediation, which should be reflected in vendor breach response protocols. (5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should confirm that internal breach response procedures are synchronized with Modal's 48-hour notification commitment. Data protection officers should assess whether the 'sufficient information' standard in the notification obligation is adequate for their regulatory reporting needs and whether supplemental information request procedures should be established in advance.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a processor-to-controller breach notification timeline of 48 hours, which is shorter than the GDPR's 72-hour controller-to-supervisory-authority window, providing Customer additional time to assess the breach and prepare regulatory notifications. The provision places the obligation to notify data subjects and supervisory authorities on Customer rather than Modal, consistent with the processor-controller relationship.
Under this clause, Modal is contractually required to notify Customer within 48 hours of detecting a data breach involving Customer Personal Data. The agreement requires Modal to provide sufficient information for Customer to fulfill its own regulatory notification obligations, but the responsibility for notifying supervisory authorities and data subjects rests with Customer as controller.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.