What happens in your organization when a data breach hits?

A data breach in your organisation can spiral from a single compromised account to a full-scale crisis within hours. The damage is rarely contained to the technical layer — it quickly spreads into legal exposure, financial loss, and reputational harm. The sections below walk through the most pressing questions organisations face when a breach occurs, from the first moments of discovery to long-term structural prevention. If you want to talk through your current situation, feel free to get in touch with us and we will help you from there.

How quickly does a data breach spiral out of control?

A data breach can escalate from an isolated incident to an organisation-wide crisis within the first 24 to 72 hours. The speed of escalation depends on how quickly the breach is detected, who is notified, and whether a response plan is already in place. Without a clear protocol, each hour of delay compounds the damage significantly.

In the first hour after discovery, the immediate challenge is containment. Systems may still be actively compromised, and without clear ownership of the response, different teams often act independently — sometimes making things worse by destroying forensic evidence or alerting the attacker prematurely. By the time leadership becomes involved, the breach has frequently already spread beyond its original entry point.

By the end of the first day, the organisation faces simultaneous pressure from multiple directions: the technical team is still assessing scope, legal counsel is reviewing notification obligations, and communications teams are fielding questions from worried employees or, worse, journalists. This convergence of pressures is where governance gaps become most visible. Organisations without a coordinated, pre-tested response structure find themselves reacting to each new development rather than managing the situation.

The longer a breach goes undetected before discovery, the worse the spiral becomes. Attackers who have had extended access to systems can exfiltrate data over weeks or months, making the eventual scope of damage far larger than initially apparent. Early detection, enabled by continuous monitoring and clear internal accountability, is the single most effective factor in limiting how far a breach can spiral.

Who inside the organisation is responsible when a breach occurs?

Responsibility for a data breach response sits across multiple roles simultaneously — there is no single person who owns it entirely. The Data Protection Officer (DPO) leads on regulatory obligations, the CISO or IT security lead manages technical containment, senior management owns the final decisions, and legal counsel guides liability exposure. All of these roles must coordinate from the moment a breach is confirmed.

In practice, the most common failure is ambiguity. When a breach occurs and no one has been explicitly assigned to lead the response, organisations lose critical time to internal debate about who should do what. Role-based accountability — defined before any incident occurs — is what separates a managed response from a chaotic one.

The DPO’s role

The Data Protection Officer is legally required under GDPR for many organisations and carries specific obligations during a breach. The DPO must assess whether personal data was involved, determine whether the breach meets the threshold for regulatory notification, and document the organisation’s response decisions. The DPO does not own the technical response, but they are the primary point of contact with the supervisory authority.

Senior management’s role

Senior leadership is responsible for authorising the response, approving external communications, and making decisions about business continuity. Critically, management cannot delegate this responsibility away — regulators and courts increasingly hold leadership personally accountable for the adequacy of the organisation’s response. This is why governance must be a management-owned function, not something left entirely to technical or legal teams.

What are the legal obligations after a data breach under GDPR?

Under GDPR, organisations must notify their supervisory authority within 72 hours of becoming aware of a personal data breach — provided the breach is likely to result in a risk to the rights and freedoms of individuals. If the breach poses a high risk, affected individuals must also be notified directly, without undue delay. Failure to meet these timelines is itself a separate infringement.

The 72-hour clock starts from the moment the organisation becomes “aware” of the breach — not from when it is fully understood. This is an important distinction. Organisations often delay notification while they complete their internal investigation, but GDPR does not require complete certainty before notifying. The obligation is to notify based on what is known at the time, with the ability to provide additional information later.

The notification to the supervisory authority must include the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it. Incomplete notifications are treated seriously and can attract additional scrutiny.

Beyond notification, GDPR requires that all personal data breaches — including those that do not meet the notification threshold — are documented internally. This documentation must include the facts of the breach, its effects, and the remedial action taken. Regulators can and do request this documentation during audits, even years after the event. Organisations that lack structured documentation practices often discover this gap at the worst possible moment.

What does a data breach actually cost an organisation?

The total cost of a data breach extends well beyond the immediate technical remediation. Organisations typically face costs across four categories: regulatory fines, legal and litigation expenses, operational disruption, and long-term reputational damage. The combination of these factors means that even a breach affecting a relatively small number of records can result in costs that far exceed what most organisations anticipate.

Regulatory fines under GDPR can reach up to 4% of global annual turnover or 20 million euros — whichever is higher. While maximum fines are not always applied, the trend across EU supervisory authorities since 2026 has been toward larger penalties for organisations that lacked adequate preventive measures or responded poorly. The adequacy of governance structures at the time of the breach is a direct factor in how regulators assess the fine.

Legal costs accumulate quickly, particularly when affected individuals pursue compensation claims or when the organisation must defend itself against regulatory investigations. These proceedings can run for months or years, requiring sustained legal resources. For smaller organisations, this sustained cost is often more damaging than the fine itself.

Operational disruption — the cost of taking systems offline, rebuilding infrastructure, and managing reduced productivity during the response — is frequently underestimated. And reputational damage, while harder to quantify, can affect customer retention, partner relationships, and the ability to win new business for years after the incident is resolved.

Why do most organisations fail to contain a breach quickly?

Most organisations fail to contain a data breach quickly because they lack a tested, role-specific response plan at the moment it is needed most. Detection is often delayed because monitoring is inconsistent, and once a breach is identified, the absence of pre-assigned responsibilities creates confusion that costs hours or days of critical response time.

There are several structural reasons this happens repeatedly, even in organisations that believe they are prepared:

Governance drift: Response plans are written once and then left untouched. By the time a breach occurs, the plan references people who have left the organisation, systems that no longer exist, or procedures that were never actually tested.
Siloed ownership: Security, privacy, and legal teams each have partial visibility but no unified coordination layer. A breach that crosses all three domains — as most do — falls into the gaps between them.
Management distance: When governance is treated as a technical or compliance function rather than a management responsibility, senior leadership is unprepared to make fast decisions under pressure.
Missing documentation: Without a clear record of data flows, system inventories, and processing activities, it is impossible to quickly assess what data was exposed and who needs to be notified.

These failures are not the result of negligence in most cases. They reflect the reality that governance is treated as a periodic exercise rather than a continuous operational capability. An organisation that reviews its incident response plan once a year is not prepared — it is simply less unprepared than one that never reviews it at all.

How should an organisation prepare before a breach happens?

Effective preparation for a data breach means building governance into the organisation as a permanent, operational capability rather than a one-time project. This includes maintaining a tested incident response plan, assigning clear roles and escalation paths, keeping data processing records current, and running regular exercises that simulate breach scenarios before they happen under real pressure.

The most resilient organisations approach preparation across several interconnected dimensions:

Documented, role-based response plans: Every person who has a responsibility during a breach should know their role before the incident occurs. Plans should be specific enough to act on, not just high-level frameworks.
Current data processing records: You cannot notify the right people about the right data if you do not know what data you hold, where it lives, and who has access to it. GDPR’s Article 30 records of processing activities are both a legal requirement and a practical response tool.
Cross-domain coordination: Security, privacy, quality, and increasingly AI governance cannot operate as separate silos. A breach in one domain almost always has implications across the others. Integrated governance structures handle this by design.
Regular testing and review: Response plans must be tested through tabletop exercises and updated whenever significant changes occur — new systems, new personnel, new regulatory requirements. Continuous governance means the plan is always current, not just current at the time it was written.
Management ownership: Preparation is not complete until senior leadership understands and has practiced their role in a breach response. Governance that lives only in the compliance team is not governance — it is documentation.

This is the kind of structural, always-active preparation that we help organisations build and maintain through our Governance-as-a-Service approach. Continuous governance means your organisation is not scrambling to find the response plan when a breach occurs — it is already operating one. If you want to understand what that looks like for your specific situation, reach out and plan a conversation with us today.

Frequently Asked Questions

How do we know if a security incident is serious enough to classify as a reportable data breach?

Not every security incident qualifies as a reportable data breach under GDPR — the threshold is whether the incident is likely to result in a risk to the rights and freedoms of individuals. A useful first test is to ask whether personal data was accessed, exfiltrated, altered, or destroyed without authorisation. If the answer is yes, or even possibly yes, you should treat it as a breach and begin your 72-hour notification assessment immediately, rather than waiting until you are certain. When in doubt, documenting your reasoning for not notifying is still required and protects you if the decision is later questioned by a regulator.

What should we do in the first hour after discovering a potential breach?

In the first hour, your priorities are containment, communication, and preservation — in that order. Isolate the affected systems if possible without destroying forensic evidence, activate your incident response plan, and notify the designated internal lead (typically your CISO or DPO) immediately. Avoid the common mistake of allowing individual team members to take uncoordinated action, such as wiping systems or resetting credentials, before a forensic baseline has been established. Those first decisions often determine how well you can reconstruct the timeline later — both for your own investigation and for any regulatory or legal proceedings.

What if our organisation does not have a DPO — who handles the regulatory obligations?

If your organisation is not legally required to appoint a DPO under GDPR, the regulatory obligations do not disappear — they simply fall to whoever holds data protection responsibility within your structure, typically a senior compliance, legal, or operations lead. The critical point is that this person must be identified and briefed before a breach occurs, not appointed in the middle of one. If there is genuine uncertainty about whether your organisation requires a DPO, that question itself warrants an immediate review, since operating without one when one is required is a separate compliance risk.

Can we notify the supervisory authority in stages if we do not have all the information within 72 hours?

Yes — GDPR explicitly permits phased notification when all the required information is not available within the 72-hour window. You notify with what you know, clearly stating that the investigation is ongoing, and then provide supplementary information as it becomes available. This is far preferable to delaying notification until you have complete certainty, which regulators treat as a more serious failure. What matters is that you can demonstrate you acted promptly and in good faith as soon as you became aware of the breach.

How often should we actually test our incident response plan, and what does a useful test look like?

At minimum, your incident response plan should be tested once a year, and additionally whenever there are significant changes to your systems, personnel, or regulatory environment. A useful test is a tabletop exercise — a structured walkthrough of a realistic breach scenario that involves every role named in the plan, including senior management. The goal is not to pass the exercise but to surface the gaps: outdated contact details, unclear decision authority, missing documentation, or coordination failures between teams. Those gaps, identified in a low-pressure exercise, are far cheaper to fix than the same gaps discovered during an actual breach.

What common mistakes do organisations make when communicating about a breach externally?

The most damaging communication mistakes are moving too slowly, saying too little, or being caught contradicting an earlier statement. Affected individuals and regulators both respond better to prompt, honest communication that acknowledges uncertainty than to silence followed by a carefully managed disclosure. All external communications — to customers, partners, the press, or regulators — should be approved by legal counsel and senior management before release, and your messaging should be consistent across every channel. Avoid the temptation to minimise the breach in early statements; if the full scope later proves larger, the credibility damage compounds significantly.

Does cyber insurance cover the costs of a data breach, and is it a substitute for strong governance?

Cyber insurance can cover a meaningful portion of breach-related costs — including forensic investigation, legal fees, regulatory response, and sometimes notification costs — but it is not a substitute for governance, and insurers are increasingly scrutinising the adequacy of an organisation's security and compliance posture before paying out. Policies often contain exclusions for breaches resulting from known vulnerabilities, inadequate controls, or failure to follow documented procedures. Strong governance does not eliminate the value of cyber insurance, but it is what makes a policy reliably claimable when you actually need it.

Navigation