A late breach notification in Spain: answering the AEPD with Claira

Lunaria Hogar S.L. sells furniture and homeware online from Valencia. Earlier this year an attacker used a support account at its hosting provider to export customer records, and Lunaria notified the Agencia Española de Protección de Datos six days after the provider's first alert. The AEPD has opened a preliminary investigation and asked for the timeline of the incident, Lunaria's internal record of the breach and the reasons the notification came when it did.

We act for Lunaria. The letter turns on Article 33(1) of the GDPR, which requires notification without undue delay and, where feasible, within 72 hours of the controller becoming aware of a breach, with reasons for any delay. Guidance from the European Data Protection Board treats a controller as aware once it has a reasonable degree of certainty that a security incident has compromised personal data. Whatever Lunaria says about that moment has to stand on its own documents.

The collection in Nuix Discover holds the mailboxes and chat exports of the data protection officer, the head of IT, the customer service manager and the managing director, with the provider's correspondence, ticket exports, a scanned copy of the processing agreement and voicemails left on the IT on-call line. Before anyone reads a document, we run Claira's early case assessment from the Claira menu. It works from the case's metadata and reports the custodians, the sender and recipient pairs, the languages and a monthly timeline that marks spikes and gaps.

Two findings shape the plan. The collection is in Spanish, with Catalan in the internal chats and English in everything from the provider, so the prompts have to cope with all three. The timeline rises sharply in the month of the incident and shows a quiet stretch in the IT mailbox just before it, which goes to the client as a question about collection. The assessment also proposes review segments, and we take the incident weeks first.

Case Context gives the review a written brief. We start one from the regulatory investigation template, which Claira calls a Review Mandate, select five documents in Discover (the AEPD's letter, Lunaria's notification, the processing agreement, the provider's incident report and the first internal ticket) and click Generate from selection. Claira drafts the sections with numbered references to their sources and lists the information it could not find, such as the names of outside counsel and the forensic firm. We answer those questions with the Agent, and a partner approves the context.

The review prompt builds on the approved context. Starting from the prompt templates with Use with context, we write a Multi-Code prompt that fills four fields in one pass: a dated event sentence that keeps the time of day where the document gives one, whether the document shows someone at Lunaria learning that customer data had left its systems, the categories of personal data mentioned, and a first privilege flag.

We test the prompt first with single review on about twenty documents chosen to be difficult: a Catalan chat thread, the scanned agreement, a voicemail and the provider's English alert sent shortly before midnight. Two rounds of edits settle the wording on what counts as learning of the breach.

The bulk scan then runs across the incident segment, with Scan as left on Auto so that Claira sends the scanned agreement as an image and the voicemails as audio. Answers are written to the team's Discover fields as the scan proceeds, and once it is under way we send it to the background and wait for the completion email. A comment on the task records its purpose and the sample behind the prompt. A second, smaller scan runs the Special category data (GDPR Article 9) template over the sample of exported records the provider supplied, since the AEPD will want to know what kinds of data left.

Much of the incident correspondence runs through outside counsel and the forensic firm they instructed, and how much of it Lunaria may withhold from the regulator is a question of Spanish law for the partner. Claira's privilege review workflow gives a first pass. Its sample prompt is written for Canadian law, so we rewrite the jurisdiction and rely on the Case Context to name the lawyers and firms. Flagged documents go to a lawyer, and nothing is withheld on Claira's call alone.

Quality control comes next. We read a sample of the documents the scan marked as showing no awareness, drawn from the days around the first alert, because a miss there would distort the chronology. The QC review workflow runs the same criteria the two associates used, and exporting Claira's answers beside their coding shows where the two disagree, which is where we read first. Prompt changes are kept as numbered versions, with the one used for the final run marked Final.

The chronology is an Insight. In Insights mode we pick the chronology template in the New insight card, choose the bulk task under Use AI results from, select the Timeline format and click Generate Insight. Claira writes a dated table from the event sentences, with citations that link to the source documents. Revise with Agent adds a column for the time of day and another for the person who learned something, and the first version stays as an earlier revision.

The timeline view groups events by date, filters by person and shows where two documents disagree about when something happened. That feature earns its place here, because the provider's alert carries a UTC timestamp, the reply from the head of IT carries Madrid time and the ticket system records a third. The rows are only as precise as the documents behind them, so a lawyer checks the entries near the 72-hour line against their sources before anything relies on them.

The chronology sets out the candidates for the moment of awareness, and choosing among them stays with the lawyers. The provider's late-night alert reported unusual exports from a support account and said nothing about whose data was involved. The head of IT asked for logs the next morning. On the third day customers began reporting phishing emails that used their order numbers, and on the fifth the forensic firm confirmed that customer records had been taken. Each date supports a different account of when Lunaria had a reasonable degree of certainty.

The EDPB's guidance allows a controller a short period of investigation to establish whether a breach has occurred, and Article 33(2) requires a processor to tell the controller without undue delay. The weight Lunaria gives to either point, its account of the quiet IT mailbox and the candour of its explanation for the days that passed are judgements for the partner and the client, made with the source documents open.

The Insight exports to Word with linked citations, a numbered list of source documents with their Document IDs, and the prompt behind it. The associates edit that export into the chronology annexed to Lunaria's response, and the Excel export gives the team a sortable copy to check against the breach record Lunaria keeps under Article 33(5). The partner writes the response letter itself, including Lunaria's account of the timing.

If the AEPD asks how the documents were reviewed, the Bulk Task History Report gives the answer. The PDF sets out the full prompt sent to the model, the model used and the comments recorded along the way, and the early case assessment downloads as its own PDF showing what the collection held before review began. Together they let Lunaria describe its method in plain terms, and they give the firm a record to return to if the preliminary investigation leads to a sanctioning procedure.