Legal counsel for the hours when the clock is already running.

A single security incident can engage three separate reporting duties, with different triggers, different clocks and different recipients. NIS2 requires an early warning to the national CSIRT within 24 hours. The Cyber Resilience Act requires notification to ENISA and the coordinating CSIRT within the same 24 hours, for actively exploited vulnerabilities and severe incidents. The GDPR requires notification to the CNPD within 72 hours where personal data is involved. None of the triggers align.

Those judgements have to be made in the first hours, on incomplete information, by people who are also trying to contain the incident. They will be examined afterwards.

Before an incident, the difficulty is different: boards are now subject to explicit governance duties, supply chains carry obligations that most contracts do not yet reflect, and the question of who decides what, and when, is rarely written down.

We act on the legal side of incident response: triage, the notification analysis across every regime that may be engaged, drafting and filing the notifications, data subject communication, evidence and privilege strategy, and the engagement with regulators that follows.

Before an incident, we work on governance and preparation — board duties under NIS2 and DORA, the contractual position with suppliers, legal tabletop exercises, and the decision-making structure that makes a 24-hour deadline survivable.

NIS2 and its Portuguese transposition · DORA · the Cyber Resilience Act · GDPR · sectoral rules · CNCS and CNPD supervisory practice. The sequence in which they bite is rarely the sequence in which the incident unfolds.