Technical & response
Incident Response
Rapidly detect, contain, and remediate security incidents to minimise damage. Article 33 gives you 72 hours from awareness; most of that is spent deciding whether you have a notifiable breach at all. We run that assessment in parallel with containment.
The regulatory clock
Awareness starts it. Uncertainty does not stop it.
Article 33(1) requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 33(4) permits phased notification where the information is not available at once. Article 34 adds communication to data subjects where the risk is high.
Hour 0–4 · Triage
Establish what is known, what is assumed and what is unknown. Confirm whether personal data is implicated. Stand up a decision log that will later evidence the reasoning.
Hour 4–24 · Contain
Isolate affected systems, revoke credentials and tokens, preserve volatile evidence before it is destroyed by remediation, and coordinate with hosting and cloud providers.
Hour 24–72 · Assess & notify
Scope the affected data subjects and data categories, assess risk under Article 33 and the severity criteria, and prepare the notification — including a phased one where the facts are still developing.
Day 3 onwards · Recover
Eradication, restoration from verified backups, enhanced monitoring during the watch period, data-subject communications where required, and a post-incident review with tracked actions.
What we do
- Incident plan development and playbooks for named scenarios
- Tabletop exercises that test the plan against the people who must use it
- Severity triage and notifiability assessment under Articles 33 and 34
- Draft supervisory-authority notifications and data-subject communications
- Containment and eradication coordination with your teams and providers
- Evidence preservation guidance and forensic specialist coordination
- Breach register maintenance under Article 33(5)
- Post-incident review with root-cause analysis and tracked corrective actions
What remains yours
Incident-response support is advisory and coordination support unless a written engagement expressly provides for an operational response role.
- Activating your internal incident plan and standing up your own team
- Preserving evidence and authorising forensic acquisition
- Business decisions: shutting services down, paying or not paying, going public
- Notifying insurers and engaging law enforcement
- Meeting statutory and contractual notification duties as controller
- Communications to customers, staff, investors and the market
Overlapping regimes
One incident, several reporting clocks
Where more than one regime applies, the earliest deadline governs the pace of the response. We reconcile them at the planning stage so the sequence is already decided when an incident starts.
| Regime | Trigger | Indicative deadline |
|---|---|---|
| GDPR Article 33 | Personal data breach likely to result in risk to data subjects | 72 hours from awareness, to the supervisory authority |
| GDPR Article 34 | Breach likely to result in high risk to data subjects | Without undue delay, to the data subjects |
| GDPR Article 33(2) | Processor becomes aware of a breach | Without undue delay, to the controller |
| NIS2 | Significant incident at an essential or important entity | Early warning within 24 hours; incident notification within 72 hours; final report within one month |
| DORA | Major ICT-related incident at a financial entity | Initial, intermediate and final reports on the timescales set by the regulatory technical standards |
| Contractual | Customer or insurer notification clauses | Frequently shorter than the statutory deadline — check the schedule |
Deadlines, thresholds and the competent authority depend on your sector, your establishment and the national implementing measures that apply to you. We confirm which apply to you at the planning stage.
Limitations you should understand before engaging
No outcome is guaranteed. DataFort Solutions Ltd. does not guarantee that an incident can be contained within a particular period, or that loss, disclosure, disruption or further compromise can be prevented. We are not an emergency service, a managed security operations centre, or a substitute for law enforcement or your supervisory authority.
Clients must provide timely access to relevant personnel, logs, systems, vendors, legal counsel and decision-makers. Delays in providing information or authority may materially limit the response available, and the post-incident report will record where that occurred.
Premium or retained support is available only where expressly included in a written engagement or service plan. It may provide priority access, extended availability and scheduled advisory sessions, but it is not a guarantee of a particular resolution time, business outcome, regulatory decision or uninterrupted availability. See sections 9 and 18 of our Terms of Service.
Incident response
Decide the hard questions before the incident.
The organisations that handle breaches well are the ones that agreed the escalation path, the decision rights and the notification criteria while nothing was on fire.