Data Breach Response — 72-Hour Protocol

Tasks in this template

1. 1
   Phase 1 — Contain the breach TODAY

   Isolate affected systems, revoke credentials, block exfiltration. Priority is stopping ongoing data loss before anything else.

2. 2
   Preserve forensic evidence (logs, system images, memory snapshots) TODAY
3. 3
   Assemble the incident response team (IT, DPO, Legal, Comms, Management) TODAY
4. 4
   Conduct initial impact assessment and classify the incident TODAY
5. 5
   Determine whether personal data is involved and in what categories D+1

   A breach triggers GDPR obligations only if personal data is affected. Document the determination either way.

6. 6
   Assess risk to rights and freedoms of data subjects (likelihood and severity) D+1

   Article 33(1): notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

7. 7
   Identify affected data subjects and estimate numbers D+1
8. 8
   Draft the supervisory authority notification D+1
9. 9
   Obtain management and legal sign-off on the notification D+2
10. 10
    Submit notification to the competent supervisory authority within 72 hours D+2

    Article 33(1): notify without undue delay and, where feasible, not later than 72 hours after becoming aware. Later notifications must explain the delay.

11. 11
    Determine whether Article 34 notification to data subjects is required D+2

    Article 34(1): required when the breach is likely to result in a high risk. Exemptions under Art. 34(3) (encryption, mitigation, disproportionate effort) must be documented.

12. 12
    If required, notify affected data subjects in clear and plain language D+3

    Article 34(2): describe the nature of the breach, DPO contact, likely consequences, and measures taken or proposed.

13. 13
    Record the breach in the internal breach register D+3

    Article 33(5): the controller must document any personal data breach, its effects, and the remedial action taken.

14. 14
    Conduct root cause analysis D+3
15. 15
    Implement remediation measures and close security gaps D+7
16. 16
    Update DPIAs for affected processing activities D+10
17. 17
    Debrief with management and document lessons learned D+14
18. 18
    Update policies, training, and controls based on findings D+21