Slightly nitpicky but the 72 hour piece is wrong here

A data controller has 72 hours to notify the ICO (or other supervisory authority). A data processor has no such obligation [unless specified as part of the data processing agreement DPA]

Most DPA will state asap s.t the controller can notify

But in this instance Blackbaud would almost certainly be a processor

(It’s a neat [nasty] little loophole