Supplier data breach: who notifies, and when does the 72-hour deadline run?

On 9 November 2026 the Norwegian Data Protection Authority (Datatilsynet) stated that it had received personal data breach notifications from, among others, Berg-Hansen Reisebureau AS and the Norwegian Air Shuttle group. The background is a breach at Amadeus IT Group, which supplies booking systems for flights, hotels and car hire to most operators in the Norwegian travel sector. According to the Norwegian National Security Authority (NSM), a threat actor had access to Amadeus’ systems for at least three years, and the vulnerability was closed on 23 September 2026. The case raises the questions of who must notify a supplier data breach, when the notification deadline starts to run, and who bears the loss.

What is known about the Amadeus breach?

NSM states that Amadeus has reported a security incident and that on 27 October 2026 NSM received a report of concern from Berg-Hansen regarding travel bookings linked to the supplier. Depending on the type of booking, the threat actor may have accessed the traveller’s identity and itinerary, passport number and nationality, contact details, ticket and flight numbers, seat information, special services, travel agency information and the content of free-text fields. According to Amadeus, the threat actor no longer has access.

The Norwegian Data Protection Authority is still mapping the scope and severity of the breach. The authority warns in particular against follow-up attacks in the form of fraudulent messages that use booking information to appear credible, and it points to the vulnerability of the supply chain. The number of persons affected in Norway has not been published, nor is it known when Amadeus informed its individual customers.

Who must notify a supplier data breach?

The duty to notify the supervisory authority rests with the controller. Under GDPR Art. 33(1) the controller must notify the breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The Regulation applies as Norwegian law under Personal Data Act Section 1. The party that has determined the purposes of the processing, in this case the travel agency or airline recording the booking, therefore cannot leave the duty to notify to the supplier.

The supplier has a separate and more limited duty. Where the supplier is a processor, it must under GDPR Art. 33(2) notify the controller without undue delay after becoming aware of the breach. Under GDPR Art. 28(3)(f) the data processing agreement must also require the supplier to assist the controller in meeting its obligations under Articles 32 to 36, including by providing the information needed for the notification.

The role of Amadeus must be assessed specifically for each service. A global distribution system that routes bookings between travel agencies, airlines and hotels may be a processor for some processing operations and an independent controller for others. In our assessment this does not change the customer’s position, because the travel agency or airline is in any event the controller for its own customer records and bookings and therefore has an independent duty to notify.

When does the 72-hour deadline start to run?

The deadline runs from when the controller became aware of the breach, not from when the breach occurred or was discovered at the supplier. In its Guidelines 9/2022 the EDPB takes the view that a controller becomes aware when it has a reasonable degree of certainty that a security incident has compromised personal data. Where the breach occurs at a processor, the controller is in principle considered to be aware once the processor has informed it.

This starting point means that delay on the supplier’s side does not count against the customer’s deadline towards the supervisory authority. It applies, however, only as long as the customer has had no other indications of the breach. Where the customer has received signals from its own systems, from customers or from public warnings, the deadline may in our assessment start to run before the formal notice from the supplier is received. Under GDPR Art. 33(4) the notification may be provided in phases, so that missing information from the supplier is no reason to delay the first notification.

Must the data subjects be informed?

Data subjects must be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms, cf. GDPR Art. 34(1). In the Amadeus breach, the combination of passport numbers, itineraries, contact details and free-text fields suggests that the threshold will often be met. The data enable identity theft and targeted fraud, and the Norwegian Data Protection Authority has itself pointed to the risk of fraudulent messages. Free-text fields may also contain health data or other special categories, for instance where assistance has been requested.

The communication must be clear and plain and describe the likely consequences and the measures data subjects can take themselves. Under GDPR Art. 34(3)(c) individual communication may be replaced by a public communication where it would involve disproportionate effort, provided that data subjects are informed in an equally effective manner. The exception must be assessed specifically and documented. The general rules on notification and communication are set out in the article on personal data breaches.

Who bears the loss after a supplier data breach?

Towards data subjects, the controller is liable for damage caused by processing that infringes the Regulation, cf. GDPR Art. 82(2). The processor is liable only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to lawful instructions. Where several parties are responsible for the same damage, they are jointly and severally liable under GDPR Art. 82(4), and a party that has paid full compensation may claim recourse for the other party’s share under GDPR Art. 82(5). Where the processor engages a sub-processor, the processor remains fully liable to the controller for the sub-processor’s performance, cf. GDPR Art. 28(4).

The customer’s own costs are governed by the contract. These include incident response, notifying customers, customer service, legal advice and any administrative fine. Standard supplier terms frequently contain a general liability cap linked to annual fees and an exclusion of indirect loss. In our assessment the customer should negotiate a separate and higher cap for breaches of data protection obligations and ensure that notification costs are not defined as indirect loss. These points are discussed further in the articles on limitation of liability in SaaS contracts and data processing agreements for SaaS.

What should organisations using Amadeus do now?

Organisations that have booked travel through services based on Amadeus should treat the case as a possible breach in their own processing and should not wait for a final account from the supplier. NSM recommends assessing the risk for travel booked before 23 September 2026 and changing login details for travel agency services. Further articles on data protection are available on the data protection topic page.

1. Establish which services and contracts involve Amadeus and which role the supplier has in each of them.
2. Document when the organisation became aware of the breach and consider whether the deadline under GDPR Art. 33(1) is already running.
3. Submit a preliminary notification to the supervisory authority where the risk cannot be excluded, and follow it up with supplementary information.
4. Consider whether data subjects must be informed, and warn them specifically against fraudulent messages concerning travel bookings.
5. Request a written account from the supplier of the period, data categories, affected bookings and measures taken, with reference to the duty of assistance in the data processing agreement.
6. Review notification deadlines, audit rights and liability caps in contracts with suppliers processing customer data, and set a specific deadline for the supplier’s notice, for example 24 or 48 hours.

Questions and answers

Next legal review: 31 January 2027