The GDPR enforces a strict deadline for reporting data breaches: Section 33: Notification of a personal data breach to the supervisory authority.
[Breach Identified] ---> Start 72-Hour Countdown Clock
                                 |
         v-----------------------+-----------------------v
[Action A: Complete Details Ready]       [Action B: Investigation Ongoing]
- Submit full incident report            - Submit phased notification updates
- Detail affected data logs              - Document mitigation steps taken
- Outline planned remediation            - Update regulator as facts emerge

If an organization cannot provide full details within 72 hours, it must submit a phased notification that explains the delay, details the information gathered so far, and outlines the steps being taken to contain the incident.
 
PreviousNext