No operator wants to think about it, but you need to know how a breach would be handled, because as controller you may have your own reporting duties.
Our commitment
Under the Data Processing Agreement, AdTech Europe will notify you without undue delay, and within 48 hours, of a personal data breach affecting data processed on your behalf.
The DPA also commits to:
- appropriate technical and organisational security measures (Article 32 GDPR): encryption in transit, least-privilege access, logging, regular backups and network protection,
- helping you with data protection impact assessments where required,
- helping you answer data subject requests.
What you should prepare now
- Know who receives the notice. Keep the contact details on your account current.
- Know your own deadline. Under the GDPR, controllers generally have 72 hours to report a breach to their supervisory authority once they become aware of it.
- Have a template for informing your advertisers, in case they must be told.
- Keep a log of every incident, even small ones.
Reporting a problem you found
If you think you've found a security problem, tell us at support@adtech.eu and give us reasonable time to fix it before sharing it, as set out in the Acceptable Use Policy.
This article is general information, not legal advice. Take your own legal advice on what applies to your business.
Related: GDPR: who is the controller? · Reporting a bad ad or a security problem
Nov 13, 2026