A personal data incident rarely looks dramatic at first. An employee sends a price list with a customer spreadsheet attached. A laptop is left on a train. A mailbox password is used from another country. The danger is not only the incident but the panic that follows: people hide it, argue about whose fault it was, or tell customers things nobody has checked.
This article describes a short routine for a small company with no legal or security department. It covers the first 72 hours. It is general information, not legal advice; rules differ by country, so check the guidance of your own regulator and ask a lawyer when a case is unclear.
Decide the roles before you need them
Write down two names on one page: the incident owner and a deputy. The owner does not fix everything. They make sure every step has a person and a time. Add the phone numbers of whoever runs your IT, your e-mail provider's support and, if you have one, your lawyer or data protection contact.
Tell the whole team one rule: if you suspect that personal data went to the wrong place or was seen by the wrong person, report it to the owner within the hour. Nobody is punished for reporting. Hiding it is the real problem. Our articles on a phishing e-mail reported by staff and a lost or stolen company laptop cover the first minutes of two common cases.
Hour 0 to 4: contain and write it down
Open a simple log, a shared document with a timestamp on every line. Record:
- When and how the incident was found, and by whom.
- What happened, in plain words, even if it is still a guess.
- What data is involved and whose: customers, employees, candidates.
- What has been done so far, and by whom.
Then contain it. Change the passwords and end the sessions of an affected account, ask the recipient of a wrong e-mail to delete it and confirm in writing, lock or remotely wipe a lost device, switch off the access that was misused. Do not delete evidence: keep the original messages and logs.
Hour 4 to 24: judge the risk to people
The key question is not "how embarrassing is this for us" but "what could happen to the people whose data it is". Ask four things:
- What kind of data is it: names and e-mails, or identity numbers, health data, bank details, passwords?
- How many people are affected?
- Was the data readable by the finder, or encrypted?
- Could it lead to fraud, discrimination, financial loss or distress?
An e-mail with a list of customer names sent to one trusted partner who deleted it is not the same as an unencrypted laptop with a full customer database. Write your conclusion and the reasoning in the log. The owner makes this decision, and a second person reads it.
Hour 24 to 72: report and inform
Under the GDPR, a personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. If you do not report, keep a written reason. If you report after 72 hours, explain the delay. Your regulator has an online form and guidance, for example the ICO in the UK. Missing details can be sent later in stages.
If the risk to the people is high, tell them directly and without delay. A good message is short and has four parts:
- What happened, and when.
- What data of theirs is involved.
- What you have done about it.
- What they can do, for example change a password, watch their bank account, and whom to contact with questions.
Do not speculate, do not blame an individual and do not promise what you cannot check. If your company is a processor for another company's data, inform that company without delay, because the duty to report may be theirs.
Keep a record even if you do not report
Every incident, reportable or not, goes into a short register: date, what happened, data, risk decision, who decided, what changed afterwards. It is the document a regulator or a customer will ask for, and it is also the best material for learning.
Learn from it within a month
Within a few weeks hold a 30-minute review without looking for a guilty person. Which control would have stopped this: a password manager, encrypted laptops, a confirmation step before sending files, a smaller access list? Choose one or two changes, give them an owner and a date. See also how to handle a customer data request, because the same register and the same owner are often useful there.
Where AI helps and where it does not
An AI assistant can turn your notes into a clean timeline, draft the first version of the message to affected people or summarise a long log for the owner. It should not decide whether the incident is reportable, and you should not paste personal data from the incident into a tool that you have not approved for that purpose. A person checks every message before it is sent.
A first step
This week, write the one-page sheet with the owner, the deputy and the contacts, and send it to everyone with the one-hour reporting rule. Create the empty log template and the register. Then run a ten-minute thought exercise: "A laptop with the customer list was lost. What do we do first?" The gaps you find are your to-do list.
