Slightly nitpicky but the 72 hour piece is wrong here
A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA]
Most DPA will state asap s.t the controller can notify
But in this instance Blackbaud would almost certainly be a processor
A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA]
Most DPA will state asap s.t the controller can notify
But in this instance Blackbaud would almost certainly be a processor
(It’s a neat [nasty] little loophole