Loading…
Note: The 72-hour deadline is specifically associated with qualifying personal data breach notifications under GDPR Article 33. It is not a universal deadline applicable to every privacy law or every security incident.
This playbook provides a practical incident-response framework for the first hours and days following a suspected personal data breach, while highlighting where notification requirements differ across jurisdictions.
When a security incident may involve personal data, organisations should move quickly to:
Under GDPR Article 33, a controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
If notification occurs after 72 hours, the notification must include reasons for the delay.
The 72-hour period should therefore be treated as an operational deadline to work towards—not as a reason to delay containment or investigation until the deadline approaches.
The GDPR clock does not necessarily begin when the underlying cyberattack first occurred.
Article 33 refers to the controller becoming aware of the personal data breach.
In practice, awareness should be assessed based on the organisation's reasonable understanding that a security incident has occurred and that personal data has been compromised.
Examples include:
A security alert does not automatically establish awareness of a personal data breach. Organisations may need a short period of investigation to determine whether personal data is actually involved.
However, investigation should not become an excuse for avoidable delay.
Operational principle: Start the incident process immediately and establish the legal notification clock as soon as the facts support a finding of awareness.
T+0 to T+6 hours
Objective: Establish whether a security incident has occurred, preserve evidence, and activate the response structure.
Depending on the incident, involve:
Initial incident summary
Document:
T+6 to T+24 hours
Objective: Stop ongoing unauthorised access while preserving evidence.
Potential actions include:
Do not destroy evidence while attempting to contain the incident.
Forensic preservation and containment should therefore be coordinated by the security response team.
Privacy notification is only one part of incident response.
Depending on the organisation and incident, separate obligations may apply to:
These obligations must be assessed independently.
Preliminary containment and scope report
T+24 to T+48 hours
Objective: Determine what happened, who may be affected, and which legal obligations are triggered.
Assess:
Determine:
Document:
Consider both the likelihood of harm and the severity of potential harm.
Potential consequences may include:
Documented risk and notification assessment
T+48 to T+72 hours
For GDPR-covered incidents, determine whether the breach is likely to result in a risk to individuals' rights and freedoms.
If notification to the supervisory authority is required, prepare the Article 33 notification.
The notification should include, where available:
If all information is not available within 72 hours, GDPR permits information to be provided in phases where appropriate.
Do not simply close the incident.
GDPR Article 33(5) requires controllers to document personal data breaches, including the facts relating to the breach, its effects, and remedial action taken.
The record should also explain why notification was or was not considered necessary.
Final notification decision + regulator filing package + internal breach record
T+72 hours and beyond
Where GDPR notification is required, submit the notification to the competent supervisory authority within the applicable deadline.
If the notification is submitted after 72 hours, document the reasons for the delay.
GDPR Article 34 contains a separate threshold.
Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must generally communicate the breach to affected individuals without undue delay, subject to the applicable exceptions.
The regulator-notification threshold and individual-notification threshold are therefore not the same.
Individual communications should generally explain:
Use clear and understandable language.
A global incident should not be managed using a single 72-hour rule.
Different jurisdictions use different:
| Jurisdiction | General approach |
|---|---|
| EU GDPR | Notify competent supervisory authority within 72 hours of awareness where the breach is likely to result in a risk, subject to the GDPR's exceptions. |
| UK GDPR | Similar 72-hour framework for qualifying breaches, subject to the UK GDPR and applicable UK requirements. |
| Singapore PDPA | A notifiable breach must be reported to the PDPC as soon as practicable and no later than 3 calendar days after the organisation determines that it is notifiable. |
| Brazil LGPD | Qualifying incidents involving relevant risk or damage are subject to notification requirements under ANPD Resolution 15/2024; the ANPD framework uses a 3-business-day period. |
| India DPDP framework | The DPDP Rules 2025 require notification to affected Data Principals without delay and notification to the Board without delay, followed by detailed information within 72 hours or a longer period permitted by the Board. The implementation timeline should be checked because the Act and Rules have phased commencement. |
| Other jurisdictions | Requirements vary substantially. Assess applicable national, sectoral, contractual, and cybersecurity reporting requirements separately. |
Important: This table is an operational overview, not a substitute for jurisdiction-specific legal analysis.
The organisation responsible for regulatory notification is not always the organisation that first discovers the incident.
Under GDPR:
A processor must notify the controller without undue delay after becoming aware of a personal data breach.
The processor should provide sufficient information to allow the controller to meet its own obligations.
The controller assesses whether the breach is subject to supervisory-authority notification and, where applicable, individual notification.
Contracts with processors should therefore establish incident-escalation procedures and sufficiently early internal notification deadlines.
A controller should not design its processor notification process around the full 72-hour regulatory window.
Practical approach: Require processors to escalate suspected personal data incidents significantly earlier than the controller's regulatory deadline.
Define responsibilities before an incident occurs.
Owns operational coordination, escalation, and response timelines.
Owns technical containment, forensic investigation, remediation, and root-cause analysis.
Supports privacy-law analysis, notification assessment, documentation, and regulator interaction within the organisation's governance model.
Provides legal advice and supports regulatory, contractual, litigation, and communications considerations where appropriate.
Coordinates customer, employee, media, and other external communications where required.
Makes business and risk decisions that require senior approval.
There should be one clearly identified decision-making process for the final notification decision.
The GDPR deadline does not automatically apply to every jurisdiction.
Regulatory notification may need to occur before every fact is known. Additional information can often be provided later.
Not every cybersecurity event involves personal data, and not every personal data breach has the same notification consequences.
For GDPR controllers, the breach still needs to be documented even when notification is not required.
Different laws apply different tests.
Customers, processors, cyber-insurance providers, and other counterparties may impose notification requirements that are earlier than statutory deadlines.
Containment actions should be coordinated with forensic preservation.
External communications should be accurate, consistent with the investigation, and coordinated with legal, privacy, security, and communications teams.
No. The 72-hour deadline is specifically associated with GDPR Article 33 notifications. Other privacy and cybersecurity laws have different requirements.
Not necessarily. Article 33 measures the deadline from when the controller becomes aware of the personal data breach.
Yes, where necessary, but the controller must provide reasons for the delay.
Do not necessarily wait for a complete investigation. GDPR allows information to be provided in phases where appropriate.
No. Under GDPR, individual notification generally depends on whether the breach is likely to result in a high risk to individuals' rights and freedoms, subject to the applicable exceptions.
The processor should notify the controller without undue delay and provide sufficient information for the controller to assess and meet its obligations.
Not automatically. Determine which authorities have jurisdiction and apply the specific rules of each relevant jurisdiction.
Potentially. Cybersecurity reporting and personal-data breach reporting are separate compliance questions. Organisations should assess the applicable CERT-In directions, sectoral requirements, contractual obligations, and the DPDP framework independently.
A breach-response plan is most valuable before a breach occurs.
Organisations should maintain:
A well-designed process should allow the organisation to move from detection to decision-making without having to create its response framework during an active incident.
RegulatoryBridge helps organisations assess privacy incidents, coordinate regulatory requirements, document notification decisions, and manage cross-jurisdiction compliance obligations.
Explore RegulatoryBridge's Emergency Response services or contact our team to discuss your incident-response requirements.