Clarity under time pressure, when NIS2, the CRA and the GDPR all start counting.

01Who it is for

Organisations in the first hours of an incident, and organisations preparing for one.

02The problem

“The notification clock is running, we have several regulators, and every decision we make now will be examined later.”

03Scope

Immediate legal triage; notification analysis across the GDPR, NIS2, DORA, the CRA and sectoral duties; drafting and filing notifications; data subject communication; evidence and privilege strategy; regulatory engagement; contractual and supplier position; post-incident review.

04Method

Hour 0–2 — triageWhat has happened, what is engaged, who needs to be in the room, and what must not be written down yet.
Hour 2–24 — the first clocksNIS2 early warning to the CSIRT. CRA early warning to ENISA where an exploited vulnerability or severe incident is in scope.
Hour 24–72 — the GDPR clock and the full notificationsBreach assessment, notification to the CNPD, and the decision on data subject communication.
Days 3–14 — regulatory engagementFollow-up filings, supervisory correspondence, and the position taken with suppliers and customers.
After — the reviewWhat the decision log shows, and what changes before the next one.

05Deliverables

Decision log
Notification assessment across every regime engaged
Filed notifications
Data subject and customer communications
Regulatory correspondence
Post-incident report

In an incident now? Call +351 919 497 920. The line is monitored outside working hours. Telephone first — do not write.

First 72 hours: what to have ready →

06How it is engaged

Availability outside working hours is contracted, not assumed. Retained incident response covers the direct route, one preparation exercise a year, and a pre-agreed rate when an incident occurs. We are also instructed on incidents as they arise, but the organisations that fare best are those that had the conversation first.

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.