Data breach: the clock starts when you become aware

A data breach is narrower and more common than most people assume. It is not only an attack: losing a laptop, emailing a spreadsheet to the wrong recipient and deleting records you were required to keep are all breaches, because the definition covers loss of availability and integrity as well as unauthorised disclosure. What makes it different from any other incident is the clock — in many jurisdictions the regulator must be told within seventy-two hours of your becoming aware.

What counts as a data breach

• Personal data sent to the wrong person, which is the single commonest category and almost always an email.
• A lost or stolen device holding personal data, whether or not anybody has looked at it.
• Unauthorised access by an insider — including a legitimate user looking at records they had no business reason to see.
• Ransomware, where availability is lost even if nothing is exfiltrated.
• Accidental deletion with no recoverable copy, which is a breach of availability rather than confidentiality.
• Misconfigured sharing: a link or folder exposed more widely than intended.

The two notification decisions

They are separate and people conflate them. The first is whether to notify the regulator, which turns on whether there is a risk to people's rights and freedoms — a low bar, and the default answer for most breaches involving identifiable individuals. The second is whether to notify the people affected, which turns on whether the risk is high, and is a bar you clear when the data could lead to fraud, discrimination or distress. A breach can require the first without the second; very few require the second without the first.

Seventy-two hours runs from awareness, not from the incident, and not from the end of your investigation. An incomplete notification made in time is expected and permitted — you may supply details later. Waiting until you understand everything is the mistake that turns a breach into two findings.

What to do in the first day

1. Contain it first — recall the email, revoke the link, isolate the device. Stopping the exposure precedes documenting it.
2. Record the time you became aware, by name, because that timestamp is the one the deadline is measured from.
3. Establish what data, whose, and how many people — approximate numbers are acceptable and expected at this stage.
4. Assess the risk to those people specifically, not the risk to the organisation; those are different questions.
5. Notify the regulator if the threshold is met, in time, with what you know.
6. Tell the people affected where the risk is high, in plain language, with what they should do about it.

The record that matters afterwards

Every breach must be logged, including the ones you decided not to report, with the reasoning for that decision. A log containing only reported breaches looks like an organisation that reports everything or notices nothing, and the unreported entries with a recorded rationale are what demonstrate judgement was exercised. The commonest finding in this area is not a late notification but an absent internal record of the small breaches that were handled sensibly and never written down.

Ettex Records holds that log with the dates, the decision and the reasoning beside the inventory of what personal data you hold, which is the information the first hour of a breach actually demands. The wider question of who does what under pressure belongs in the incident response plan rather than here.