A personal data breach starts a regulatory clock that doesn't stop for weekends, holidays, or executive availability. Under GDPR Article 33 you have 72 hours from awareness to notify the Supervisory Authority. DPDPA Rule 7, PDPA Section 26B, and LGPD Resolution 15/2024 set similar windows.

This playbook breaks the 72 hours into five named phases — Detection, Containment, Assessment, Documentation, Filing — with concrete deliverables at each gate. Use it as a runbook: when something is on fire you don't want to be writing process. You want to be executing it.

Article 33 says "not later than 72 hours after having become aware of it." Awareness is when the controller has reasonable degree of certainty that a security incident has occurred and that personal data is involved. It is not:

• The moment the incident actually occurred.
• The moment an automated alert fired.
• The moment the first analyst started investigating.
• The moment a vendor reported a sub-processor incident — but the clock typically starts when you have enough information to assess the controller's data is in scope.

EDPB Guidelines 9/2022 on personal data breach notification permit a short investigation period to reach awareness, but that period should be brief — a matter of hours, not days.

Goal: Confirm an incident has occurred, preserve forensic evidence, activate the response team.

• Triage signal. Was the alert real? IDS hit, suspicious export, vendor disclosure, customer report.
• Preserve forensic integrity. Snapshot affected systems, freeze logs, do not power off if memory artefacts matter.
• Open the case file. Issue an incident ID. Every action from here is logged against it.
• Activate the war room. DPO, CISO/Head of Security, Legal counsel, Communications, and a designated Incident Commander.
• Identify the responsible processor / sub-processor if the incident originated externally; engage their incident-response contact.

Deliverable at T+6h: One-page incident summary — what happened, when, what systems, what data categories may be involved, what is known unknown.

Goal: Stop the bleed, isolate affected systems, and notify time-sensitive external parties.

• Block ongoing exfiltration. Rotate credentials, revoke OAuth tokens, terminate sessions, block exit traffic.
• Isolate affected systems while preserving evidence.
• CERT-In / sectoral notifications. India: CERT-In within 6 hours for designated incidents. US sectoral: HHS OCR (HIPAA), FTC, state AGs.
• Engage external counsel if material exposure is plausible — privilege is best established early.
• Engage cyber insurance carrier per policy notification requirements (often within 48 hours; some carriers offer 24/7 hotlines).
• Begin victim-identification work — categories of data subjects, approximate volume, geographic spread.

Deliverable at T+24h: Containment confirmation; preliminary scope statement.

Goal: Determine the magnitude and likely harm — this drives every downstream decision.

• Categories of personal data affected. Identifiers? Contact data? Financial? Special-category (Article 9 GDPR)? Children's data?
• Volume. Exact record count if known; otherwise reasoned estimate.
• Affected data subjects. Employees, customers, vendor contacts, end-users? In which jurisdictions?
• Likelihood and severity of harm. Use Article 33(3)(c) framing — identity theft, fraud, financial loss, reputational damage, discrimination, loss of confidentiality of professional secrecy.
• Apply notification thresholds. GDPR: notify SA unless "unlikely to result in a risk to the rights and freedoms of natural persons." LGPD: ANPD notification for breaches that can cause "relevant risk or damage." PDPA-SG: 500+ individuals OR significant harm.
• Decide on the regulator side. Lead Supervisory Authority for cross-border GDPR. Multiple regulators if processing crosses regions.

Deliverable at T+48h: Risk-of-harm assessment; notification decision matrix; draft notification template populated.

Goal: Build the artefact you'll file, lock the internal record, brief stakeholders.

• Article 33(3) content set for the SA filing:
  1. Description of the breach (nature, categories, approximate number of data subjects and records).
  2. Name and contact of the DPO or other contact point.
  3. Likely consequences of the breach.
  4. Measures taken or proposed to address the breach and mitigate possible adverse effects.
• Internal Article 33(5) record. Even if you don't notify, document the breach internally; SAs ask for these records in audits.
• Senior management briefing. CEO, board, audit committee per your incident response policy.
• Comms plan finalisation. Customer communication template, FAQ, executive talking points, social-media monitoring on standby.
• Sub-processor coordination. Where the breach originated upstream, align notification messaging and timing.

Deliverable at T+72h: Filing-ready notification; complete internal record.

Goal: Notify regulators within the statutory window and communicate to data subjects where required.

• SA filing via the official portal (most EU DPAs have web forms; ICO uses an online form; ANPD uses an electronic protocol). Save the receipt — it's the only proof of timing.
• Multi-jurisdiction filings. Where you have multiple lead SAs (rare), one-stop-shop applies; otherwise notify each competent authority separately.
• Data subject communication if high risk (Article 34): clear and plain language, name + contact of DPO, likely consequences, mitigation measures, advice.
• Public statement if material to investors or under sector rules (SEC 8-K, SAR-style reporting).
• Internal all-hands before the public announcement to control narrative.

Deliverable at T+72h+: Filing acknowledgement; data-subject communications dispatched (or documented decision not to communicate); post-incident review scheduled within 14 days.

• Incident Commander — owns tempo, calls phase transitions, escalates blockers.
• DPO / Privacy Officer — owns the regulator notification decision and content.
• CISO / Security lead — owns containment, forensics, root-cause analysis.
• General Counsel / External Counsel — owns privilege, communications review, regulator engagement strategy.
• Communications — owns external messaging, social monitoring, press response.
• CEO / Senior leadership — owns reputational decisions, customer-facing apologies, post-incident commitments.

The most common organisational failure is unclear ownership between the DPO and General Counsel for the actual regulator filing. Settle it in advance — most teams default the DPO drafting under counsel privilege, with the DPO as the named contact in the filing itself.

Article 34 GDPR triggers data subject communication when there is a high risk to rights and freedoms. The standard is higher than the SA notification threshold. Examples warranting notification:

• Unencrypted financial account details, identifiers used for authentication.
• Special-category data (health, genetic, biometric, political, religious).
• Information enabling identity theft or financial fraud.
• Children's data of any meaningful sensitivity.

Article 34(3) lists three exemptions to direct communication: encryption rendering data unintelligible to unauthorised persons, measures eliminating the high risk, or a disproportionate effort that can be replaced by public communication.

Notification content (Article 34(2)): nature of the breach, name and contact of DPO, likely consequences, measures taken. In plain language.

• Starting the clock at the wrong moment. SAs scrutinise when "awareness" was reached. If your IR team was investigating for 5 days before declaring an incident, that gap looks like delay.
• Underestimating scope. The fastest way to lose regulator goodwill is to under-report initial numbers and then dramatically revise upward.
• No documented assessment. If you decide not to notify, Article 33(5) still requires an internal record of the breach and the reasoning.
• Notifying the wrong SA. One-stop-shop only applies to cross-border processing under GDPR. Local-only processing must be notified to the local SA — not your lead.
• Customer communication before regulator filing. Order matters in practice: regulators view it as good-faith engagement, customers don't care which came first.
• Forgetting CERT-In's 6-hour window for India. Frequently missed by global teams unfamiliar with India's sectoral overlay.
• Not preserving forensic evidence. Powering down a compromised host can destroy memory-resident malware indicators.