In the first hours of an incident.

The line is monitored outside working hours. Telephone first — do not write. An email describing a live incident is a written record made before anyone has advised you on what it should say.

01What to have ready

You do not need answers to all of this before calling. Having it to hand makes the first conversation shorter, and the first conversation is the one that shapes everything after it.

When the incident was detected, and by whom
What is known about how it started, and whether it is contained
Which systems are affected, and which are merely suspected
Whether personal data is involved, and roughly whose and how much
Whether the organisation is an essential or important entity under NIS2, a financial entity under DORA, or a manufacturer of products with digital elements under the CRA
Which suppliers or service providers are involved, and what the contracts say about notification
Who inside the organisation already knows, and what has been said in writing
Whether any customer, regulator or third party has already been told anything
Whether insurers have been notified, and what the policy requires

02What not to do in the first hours

Do not circulate speculation about cause or attribution in writing
Do not confirm to customers or counterparties what you cannot yet evidence
Do not destroy or overwrite logs, images or evidence while deciding what to do
Do not start a notification you cannot finish — a filed notification is a fixed position
Do not assume one regulator covers the others. They do not

03The clocks

24 hours — early warning to the national CSIRT under NIS2, where the incident is significant.

24 hours — early warning to ENISA and the coordinating CSIRT under the Cyber Resilience Act, for actively exploited vulnerabilities and severe incidents.

72 hours — notification to the CNPD under the GDPR, where there is a personal data breach likely to result in a risk.

Sectoral and contractual duties may run alongside all three.

04What we do, and what we do not

We act on the legal side: triage, notification analysis across every regime engaged, drafting and filing, data subject communication, evidence and privilege strategy, and the regulatory engagement that follows.

We do not provide technical security services. No SOC, no testing, no managed detection, no digital forensics. We work alongside your own providers, or alongside specialists identified for the matter.

The full engagement →

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.