The First 72 Hours After a Data Breach: A Checklist for Companies

The Personal Data Protection Board has decided that data controllers must notify the Board without delay and within 72 hours at the latest of becoming aware of a breach. Affected individuals must also be notified within a reasonable time.

1. Detection and Containment

As soon as a breach is suspected, the IT team should step in, affected systems should be isolated and logs showing the scope of the incident should be preserved.

2. Assessment

Identify which data categories, how many people and which systems are affected, and separately assess whether special categories of personal data are involved.

3. Notification

Notify the Board using the Data Breach Notification Form it has published; if not all information is available, complete it later. For late notifications, explain the reasons for the delay.

4. Recording and Improvement

Record the causes, effects and measures taken, and update technical and organisational measures to prevent recurrence. A breach response plan prepared in advance makes this process much easier.