A Dutch business may face a 72-hour reporting period after discovering a personal-data breach. It applies when the breach likely risks people’s rights and freedoms. People may need notice where the likely risk is high. Every breach needs an internal record, including unreported breaches.
Why this matters
The first hours pull staff from client work and can delay invoices. Management needs access logs, supplier contacts, contracts and an incident record. A full investigation may not fit within the reporting period. Missing details can follow if the delay is explained. An IT supplier can block accounts or retrieve logs. Management still makes the legal and customer decisions.
Example
A payroll spreadsheet goes to the wrong customer. It contains names, addresses and bank details. The business confirms who received it and requests secure deletion. It keeps the email record and checks whether the file was opened or shared. Management records the likely harm, containment work and notification decision. If it processes data for a client, it follows the contract’s escalation route without unreasonable delay.
XTROVERSO tips
- Name the incident owner. Give one person authority to coordinate facts, suppliers, customer contact and the incident file. Arrange cover for absences.
- Protect the evidence. Keep emails, access logs, account records and supplier messages. Preserve them before resetting accounts or deleting files.
- Map the data and roles. Record whose data is involved, where it sits and why it is processed. Confirm whether you are controller or processor.
- Check contracts and contacts. Review customer, payroll, cloud and IT contracts. Keep contact details current and note any shorter escalation deadlines.
- Separate the decisions. Assess regulator notification and communication with affected people separately. Record the facts and reasoning for each decision.
- Control everyday AI use. Set a clear rule for personal data entered into AI-enabled software. Check supplier terms and business account settings.
Let’s build an incident process your staff can use when the clock starts
The data, sourcing, and analysis behind this article were conducted by Paolo Maria Pavan. AI was not used to identify sources, build the factual basis, or produce the analytical judgment contained here. AI was used only as a drafting aid. The final English text was personally reviewed, edited, and approved by Paolo Maria Pavan before publication.
