If you have just discovered an incident

Keep the case ID, clock and evidence in a restricted company file. These first actions can run in parallel.

Right now · Duty lead and engineering

Stop any further exposure. Disable the affected sharing link, connector or automated action, preserve the relevant logs and move to a safe manual service. Call the named incident lead or deputy. Use an alternative trusted channel if the usual account might be compromised. NCSC

Write down two times · Incident lead

Record the first alert and the time you had reasonable certainty that personal data were compromised. Record the evidence and time zone for each. Include data changed, destroyed or made unavailable. Investigate a suspected breach promptly. EDPB-BREACH · ICO-BGUIDE

Who must be told? · Privacy lead or founder

Processor for this service? Tell the affected controller without undue delay from awareness. Follow the contracted incident route. Send known facts now and update them. EU-GDPR · UK-GDPR · ICO-CONTRACT

Controller? For a personal data breach, notify the competent authority unless risk to people’s rights and freedoms is unlikely. Act without undue delay and where feasible within 72 elapsed hours of awareness. If incomplete, send the available facts and follow up. Explain any delay. ICO-REPORT · EDPB-DOORS · EDPB-BREACH

Likely high risk to people? Inform them in clear language without undue delay, subject to the Article 34 exceptions. Use a safe contact route and give an immediately useful protective step. Record every personal data breach and what informed the decisions. EU-GDPR · UK-GDPR · ICO-BGUIDE

Before reconnecting · Operations lead

Demonstrate that the exposure is fixed. Confirm who owns further notifications, affected people’s questions, restore testing, ongoing monitoring and the next update. NCSC · EDPB-EX

UK reporting form · EU national reporting routes · Full procedure, message templates and weekend drill

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.