The notification rule is explained in the NDPC's data-protection guidance. Under NDPA 2023, notify the NDPC within 72 hours of awareness where a personal data breach is likely to risk individuals' rights and freedoms. High-risk breaches also require communication to affected data subjects. Not every security incident meets that threshold.
The statute should be read alongside GAID 2025, issued on 20 March 2025. Together they make incident handling a governance and systems concern. A controller needs timely information from processors, clear internal escalation and a documented assessment of the people affected. Review the duties against your data-protection control design before an incident occurs. This article is practical engineering guidance, not a substitute for legal interpretation. The DPO, responsible management and incident responders should agree who assesses risk, who approves communications and how incomplete information is recorded without delaying required action.
When awareness starts the notification clock
Do not wait for a complete forensic report before considering the clock. Record when the organisation became aware, what was known at that point and how the assessment developed. Distinguish the first alert from the evidence establishing a personal data breach, and retain the basis for that distinction.
Give each part of the assessment an accountable owner:
- Incident lead: coordinates containment, evidence collection and the incident timeline.
- Privacy lead or DPO: assesses risks to individuals and advises on notification requirements.
- Service and data owners: identify affected systems, records, processors and business dependencies.
- Accountable management: approves actions and ensures response decisions have appropriate cover.
A shared incident record should hold the awareness timestamp, decisions and unresolved questions. It is more reliable than trying to reconstruct the response from private messages after the deadline has passed.
Replace assumptions with incident evidence
A useful risk assessment names the affected data, people, likely consequences and existing safeguards. Record what is confirmed, what remains uncertain and what investigation will resolve it. An unsupported statement that data was encrypted is not enough: check how keys and access were protected. Use the GAID implementation guidanceto frame the organisation's responsibilities, while technical teams establish the facts of exposure and containment.
Keep legal interpretation tied to the actual incident. The NDPC FAQs explain the risk-based notification approach. A blocked attack with no personal data breach is different from confirmed unauthorised access to identifiable records. Document both the conclusion and its evidence, including the reason for any decision not to notify, and revisit it if new facts emerge.
Useful evidence normally includes:
- An incident timeline: alert, awareness, containment and assessment timestamps, with time zones and named decision-makers. Preserve earlier versions when the facts change rather than overwriting the record.
- An affected-data inventory: systems, record types, data subjects and likely exposure paths.
- Access and activity logs: relevant authentication, API, export and administrative events.
- A decision register: risk assessments, notification decisions, approvals and follow-up actions.
Give the response team clear responsibilities
The response should not depend on locating one person who knows the application. Define deputies, escalation routes and authority to isolate a service. Include processors and outsourced operators in the plan, with practical routes for urgent incident information.
Controllers and processors of major importance must designate a DPO. GAID addresses DPO independence and internal reporting, alongside registration and audit-return matters. Do not assume every SME has identical filing duties: obligations depend on designation and category. During an incident, the DPO needs timely access to relevant facts and a reporting route that allows independent advice. Engineering should supply evidence without making legal decisions alone, and management should record who accepted or rejected a proposed action.
Give responders controlled access to evidence
Responders need enough access to establish scope without turning the investigation into a second disclosure. Use named accounts, time-limited permissions and a restricted evidence store. Keep a record of sensitive exports and the people permitted to inspect them.
Design those permissions into normal operating tools. Emergency access should be approved and reviewed, not a shared password pasted into a chat. A usable incident queue, clear status labels and an evidence index help teams act without broadening access unnecessarily. The same workflow discipline underpins internal tools people actually use..
Prepare the notification before an incident
Prepare a notification workflow, contact register and draft information checklist before a breach. Confirm the current submission route with the responsible privacy team. A template saves time only if it prompts for the affected data, likely consequences, mitigation and accountable contact rather than encouraging unsupported certainty.
Keep public statements, processor notices and data-subject communications consistent with the incident record. High-risk breaches require communication to affected subjects as well as the relevant authority notification. Agree who can publish, who can answer follow-up questions and how updates will be approved as facts develop.
Test the response before a breach, not during one
Run a tabletop exercise that starts with an ambiguous alert and incomplete evidence. Include a processor that responds late, a missing log source and an unavailable approver. The test should show whether teams can reach and record decisions within the applicable notification window.
Use task-based exercises rather than a slide presentation. The response interface should make ownership and next actions visible, following the principles in designing internal tools people actually use. Test evidence retrieval, emergency access and communications approval together with data loss prevention controls. A DLP alert can help identify exposure, but it does not decide whether a breach is notifiable. Compare alert coverage with actual data flows and review how endpoint and network controls fit the wider estate in choosing your security stack..
Avoid equating containment with completion. The organisation still needs a documented risk decision, any required communications, remediation ownership and a review of what the response missed.
Preserve records without spreading the breach
Restrict evidence copies, record provenance and preserve original logs where possible. Use controlled working copies for analysis, with access and retention agreed by the responsible teams. Do not send full customer datasets to every stakeholder who wants a progress update.
The GAID's implementation detail should inform the governance around these records. Retention, access and deletion decisions need to account for applicable legal obligations and the investigation's needs. Keep an evidence index and version history so later reviewers can distinguish the original facts from corrected interpretations. The incident report should explain what changed and why, not present hindsight as if it had been known from the first alert.
Checklist: your breach-response readiness review
- The incident plan records how awareness and the relevant clock are established.
- Responders can identify affected data, individuals and likely consequences.
- The privacy lead has an independent route to accountable management.
- Processor contacts and internal deputies are available and tested.
- Notification and data-subject communication decisions have named owners.
- Logs and evidence can be retrieved without unrestricted data exports.
- Containment actions, risk decisions and communications retain timestamps.
- Exercises test incomplete evidence, absent approvers and late supplier responses.
Breach readiness is a property of systems, people and decisions, not a policy document alone. We help connect incident evidence and practical controls through Data loss prevention (DLP). If your current response depends on manual searches and unclear handoffs, talk to us.
