Data Breach Notification
The legal obligation to inform supervisory authorities and affected individuals when a personal data breach occurs. GDPR requires notification to authorities within 72 hours. NIS2 requires initial notification within 24 hours for significant incidents.
Why it matters
Late or missing breach notifications are among the most common GDPR enforcement actions, often resulting in fines independent of the breach itself. The 72-hour clock starts ticking when you become aware of the breach, not when you finish investigating it. Organizations without a prepared notification process waste critical hours figuring out who to contact, what to report, and how to assess the impact. That delay itself becomes a compliance violation.
In practice
Breach notification requires pre-built templates, clear escalation paths, documented assessment criteria for determining whether notification is required, and contact details for relevant supervisory authorities. The notification must describe the nature of the breach, approximate number of affected individuals, likely consequences, and measures taken. In vucavoid, incidents are tracked with classification, timeline, and impact assessment, providing the structured data needed to meet notification requirements without starting from scratch under pressure.