Personal data breach: organising the first 72 hours so you can act

The clock starts with reliable awareness

The organisation must escalate incidents so that privacy, security, legal and the business can assess them in time. Where a notification is required, the GDPR in principle provides for a notification where feasible within 72 hours of becoming aware.

Assessment and containment run in parallel

Affected data and persons, scale, safeguards, possible consequences and countermeasures already taken are documented continuously. The decision not to notify also needs a traceable justification.

• Secure the event and limit further disclosure
• Determine data types, affected persons and possible consequences
• Assess notification and communication obligations
• Log decisions, timings and measures