Controllers report to IMY. Processors must tell the controller without undue delay. Contracts with processors should set out how fast and in what form they will notify you.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Check notification terms in data processing agreements
- Know which role you have for each system
- Test the chain with key processors
Making it stick
Delays at a processor eat into your 72 hours. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.