Data breach notification
The clock that starts the moment you learn of a leak: tell the regulator (often within 72 hours) and tell affected users when the risk is high.
See it
What it is
A breach is not only a hacker. Under GDPR it covers any accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data, so a misconfigured storage bucket, a CSV mailed to the wrong list, and a lost laptop all qualify. Not every one of them gets reported, though. Article 33 gives you 72 hours from awareness (not from containment, not from a finished forensics report) to notify your supervisory authority, unless the breach is unlikely to result in a risk to people's rights and freedoms. Article 34 raises the bar again: you tell the affected people, without undue delay, only when the risk to them is likely to be high. You record every breach internally either way, including the ones you decide not to report and why.
US state laws stack on top, each with its own trigger and deadline, and sector rules add more. The strictest clock is often not the law at all: enterprise DPAs routinely bury a 24-hour or 48-hour notice obligation to your customer. Encryption strong enough to render the data unreadable is the usual safe harbor for skipping user notification.
The gotcha is that the risk assessment happens inside the 72 hours, not before the clock starts. The threshold is real, but 'we were still working out how bad it was' does not buy you extra days. You are explicitly allowed to file an incomplete notification and follow up in phases, and regulators punish late disclosure far more predictably than they punish the breach itself. Write the decision tree and the templates while nothing is on fire.
Ask AI for it
Draft an incident response runbook for a personal data breach at a SaaS company. Build three separate decision paths rather than one notify-everyone flow. Path one, always: record the breach in an internal register with the facts, the risk assessment, and the decision, whether or not anyone is told. Path two, authority notification: notify the supervisory authority within 72 hours of awareness unless the breach is unlikely to result in a risk to people's rights and freedoms, and make the runbook show the reasoning that supports either answer. Path three, individual notification: contact affected people without undue delay only when a high risk to them is likely, and note the exemptions (effective encryption, measures that neutralize the risk, disproportionate effort plus a public communication). Include a severity triage table mapping incident types to which paths fire, a 72-hour timeline measured from awareness with a named owner for each step (containment, forensic snapshot, risk assessment, regulator filing, customer comms, subprocessor and insurer notice), and a GDPR Article 33 template covering nature of the breach, categories and approximate number of data subjects and records, DPO contact, likely consequences, and measures taken. Finish with a plain-English customer email, to be sent only when path three fires: no hedging, no 'out of an abundance of caution', a clear statement of what was and was not exposed, and one concrete action the reader should take today.