Breaches rarely start with a clean alert. They start with somebody flagging a strange email, a laptop that cannot be found or a system that came up encrypted. The platform team is called, containment starts and everyone waits to understand the scope. Meanwhile a clock is running that nobody can stop afterwards.

The General Data Protection Regulation gives 72 hours from the moment the organisation becomes aware of the breach to notify the supervisory authority, unless it is unlikely to result in a risk to people. If the risk is high, affected individuals must be told without undue delay. And whether it is notified or not, the decision and its reasoning are documented. The penalties that reach the press rarely punish the attack itself. They punish being unprepared and reporting late or badly.

Four rules hold the control up.

  1. A breach does not need an attacker. A message sent to the wrong recipient, a lost device or encryption without exfiltration are also breaches. What counts is that personal data was lost, altered or seen by someone who should not have seen it.
  2. The clock starts on awareness. Not when the forensic report confirms it weeks later. From that moment there are 72 hours to notify, and notification can be phased with what is known. Arriving late means explaining why.
  3. To the affected people, without delay and in plain language. What happened, what it may mean for them, what they can do and who to ask.
  4. Everything is recorded, even when nothing is notified. The internal breach register is mandatory and it is the first thing an inspection asks for.

The penalty rarely punishes the attack. It punishes the decision nobody documented.

What the auditor tests

This control is not audited by reading the procedure. It is audited on breaches that already happened, including those closed without notifying.

  • The time of awareness. What is recorded as the moment the organisation knew, and what evidence supports it. Everything else hangs on that timestamp and it is almost never recorded that precisely.
  • The chain up to the decision. Who assessed the risk, against what criteria and who approved notifying or not. A decision without an author is a decision you cannot defend.
  • The complete internal register. Reconcile the register against the period's incidents in the ticketing system. Breaches that never reached the register are the finding.
  • Evidence of the rehearsal. When it was last simulated, who took part and what changed afterwards. A plan never rehearsed is a document, not a control.
  • The processors. The window in which your suppliers notify you, and the evidence of the last time they met it.

Most of the work is gathering scattered evidence and putting it in time order, which is the same difficulty that shows up in any incident review. When that reconstruction is done by hand the cost falls on the whole cycle, and that is what the capability gap the profession measures is about.

A prepared organisation is not the one that promises to notify on time. It is the one that can show, for a specific breach, what time it knew, who decided what and on what evidence.