The DPA states that Modal will notify Customer within 48 hours of becoming aware of a data breach affecting Customer Personal Data, providing information sufficient for Customer to meet its own reporting and data subject notification obligations under applicable privacy laws.
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a processor-to-controller breach notification timeline of 48 hours, which is shorter than the GDPR's 72-hour controller-to-supervisory-authority window, providing Customer additional time to assess the breach and prepare regulatory notifications. The provision places the obligation to notify data subjects and supervisory authorities on Customer rather than Modal, consistent with the processor-controller relationship.
Under this clause, Modal is contractually required to notify Customer within 48 hours of detecting a data breach involving Customer Personal Data. The agreement requires Modal to provide sufficient information for Customer to fulfill its own regulatory notification obligations, but the responsibility for notifying supervisory authorities and data subjects rests with Customer as controller.
Cross-platform context
See how other platforms handle 48-Hour Data Breach Notification and similar clauses.
Compare across platforms →"Processor shall notify Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information to allow the Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Applicable Privacy Laws.Excerpt from Modal's Terms of Service
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 33 (notification to supervisory authority within 72 hours) and Article 34 (communication to data subjects), as well as equivalent provisions under UK GDPR and US state …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a processor-to-controller breach notification timeline of 48 hours, which is shorter than the GDPR's 72-hour controller-to-supervisory-authority window, providing Customer additional time to assess the breach and prepare regulatory notifications. The provision places the obligation to notify data subjects and supervisory authorities on Customer rather than Modal, consistent with the processor-controller relationship.
Under this clause, Modal is contractually required to notify Customer within 48 hours of detecting a data breach involving Customer Personal Data. The agreement requires Modal to provide sufficient information for Customer to fulfill its own regulatory notification obligations, but the responsibility for notifying supervisory authorities and data subjects rests with Customer as controller.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.