--- title: "Data Breach Response | Pitch" description: "Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source." url: https://www.pitch.law/solutions/data-breach-response-enforcement --- [pitch](https://www.pitch.law/) [Solutions](https://www.pitch.law/solutions) [Privacy & Data Protection](https://www.pitch.law/solution-categories/privacy) # Data Breach Response Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source. - 360 stage: Enforce ## The question Your systems have been compromised, an email went to the wrong recipients, or a supplier tells you it lost your data. What must you do, and by when? Two clocks start. Under Article 33 GDPR you must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Where the risk is high, Article 34 also requires you to inform the individuals concerned without undue delay. If your organisation falls under NIS2, a separate and shorter reporting duty towards the national cybersecurity authority may apply to the same incident. Each member state implements NIS2 in its own law, and the report goes to the authority that member state has designated. The [72-hour rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) and [NIS2](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) are explained in our Knowledge Base. Beyond the reporting, there may be a dispute: someone stole or published the data, a supplier failed in its security duties, or a former employee took a customer file. ## Our approach In the first hours we do four things in parallel. We establish what happened and which data is affected. We help you contain it. We assess whether the breach is notifiable, using the likelihood and severity of harm to the individuals as the test, and we record the reasoning. And we start the clock in [our breach handling workflow](https://www.pitch.law/technologies/breach-response-workflow), which gives each breach a reference, counts down the 72 hours and keeps the facts, decisions and tasks in one record. Notification to the supervisory authority can be staged: Article 33(4) lets you provide information in phases when you do not yet have everything. Which authority that is depends on where you are established and where the processing takes place. We prepare the notification with the content Article 33(3) requires, and a lawyer decides on it and approves it before it is sent. The same applies to the message to individuals, which must be written in clear language and say what they can do to protect themselves. Where several organisations are involved, we sort out who is controller and who is processor, since a processor has to inform the controller without undue delay. Every breach must be documented, including those you do not notify (Article 33(5)). The workflow does not let a high-risk breach be closed until either the individuals have been informed or the reason for not doing so has been recorded. Exceptions exist, for instance where the data was encrypted so that it is unintelligible, but they must be justified in writing. Individuals frequently react to a breach with access or erasure requests. [Our data subject request function](https://www.pitch.law/technologies/dsar-handling) logs them and keeps the one-month deadline visible while the incident is still running. In parallel, and only if you want it, we look at the other side: preserving evidence, putting the supplier on notice, sending cease-and-desist letters or takedown requests to hosts and platforms where stolen data is published, and advising on claims and on the regulator's follow-up. Clients contact us when a laptop is stolen, a phishing mail has given an attacker access to a mailbox, a customer list was sent to the wrong group, a supplier reports that its systems were compromised, or when they find their data on a website or marketplace and do not know whether to act as victim, controller or both. ## What you get - A documented notifiability assessment and, where required, the notification to the authority and the message to individuals. - A complete breach file that holds up if the authority asks questions. - Advice on any parallel NIS2 reporting and on contractual notices to suppliers. - Where you want it, enforcement steps against the source of the breach. - After the incident, a short review and an update of your response plan and register entries. A manufacturer discovers on a Thursday that a former sales employee has copied the customer database, with contact details of about 2,000 business contacts, to a private cloud account. We open a breach file, record the time of awareness and assess the risk: business contact data, no sensitive categories, low likelihood of harm to the individuals. The lawyer concludes that notification to the authority is not required, and the reasoning is recorded. In parallel, the company has a different problem, misuse of confidential information and customer data, and we send a cease-and-desist letter to the former employee and a request to the cloud provider to preserve and remove the data, while advising on the employment and trade-secret aspects. ## Next step The best moment to prepare is before an incident. We can set up your response plan, roles and ready-to-use letters, and test them. If you are in the middle of a breach now, don't wait: the clock is already running. [Contact us](https://www.pitch.law/contact-us) straight away or [schedule a meeting](https://www.pitch.law/schedule). ## In short - Notifiability assessed and documented - Notification to the authority prepared and checked by a lawyer - Individuals informed where the risk is high - Action against whoever caused or exploited the breach - Response plan ready before an incident ## Technology we use - [Technology](https://www.pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://www.pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://www.pitch.law/technologies/breach-response-workflow) - [Technology](https://www.pitch.law/technologies/dsar-handling) ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) ## Background reading - [Academy](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - [Academy](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) ### [The NIS2 Directive](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) [Who falls under NIS2, what the directive requires, how the 24-hour, 72-hour and one-month incident reports work and how they relate to GDPR breach notification.](https://www.pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework) ## More in Privacy & Data Protection - ### [Data Processing Agreements](https://www.pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://www.pitch.law/solutions/data-processing-agreements) - ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)