The first 72 hours

Most breaches are not hacks

A misdirected email, a lost laptop, a folder shared with the wrong permissions, a letter to a former address. Ordinary, frequent, and exactly the kind of thing that gets mentioned to a colleague and never recorded.

Awareness is a moment, and it is worth timestamping

The 72 hours runs from becoming aware, not from the incident happening and not from finishing the investigation. If somebody reported it on Tuesday afternoon, that is the time. Recording it explicitly — separately from when the incident occurred and when it was written up — removes the argument later.

The decision is about risk to people

Notification to the regulator is required unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where the risk is high, the individuals themselves have to be told. Both are assessments about the people affected, not about the organisation embarrassed.

The ones you do not report still get written down

Every personal data breach has to be documented — the facts, the effects, the remedial action — whether or not it was notifiable. Organisations that log only the reported ones have, in effect, no log at all, and the decision not to report is precisely the one you will be asked to justify.

What good looks like a year later

A dated record of when you knew, what you assessed, what you decided and why, what you told whom, and what changed afterwards. That is a short document. It is almost never written at the time, which is the only reason it is hard.

This guide describes what organisations are commonly asked for. It is not legal advice and it is not a statement of what your organisation must do — that depends on your premises, your activities and your own assessment, and it is a question for you and your adviser. The regime pages linked below name the legislation so you can read the source.