How to recognise an incident, assess the risk to individuals and decide whether to report it, with the deadlines that apply.
Legal status: August 2026
See also: DPO and GDPR NIS2 and KSC Training and workshops AI Act
A structured response to incidents and breachesThe first hours decide what you are able to demonstrate later. If you want the sequence of steps agreed before anything happens, let us talk about your processes. Explore the service
A significant incident report is not one document but a sequence of four submissions. An early warning within 24 hours, a report within 72 hours, an interim report and a final report. The Act sets the content of each, and incomplete knowledge is no reason to wait.
Article 33(5) GDPR requires documentation, not a register in a prescribed form. The documentation has to let the supervisory authority verify compliance with the whole article, which is why the entries that call for the most content are those on breaches the controller did not notify.
An incident under the Polish KSC act and a breach under the GDPR are two independent determinations of the same event. The scopes overlap but neither contains the other, so settling one does not close the other.
First confirm the event and secure the evidence, then limit the effects, and only then qualify the matter legally. Detection starts several independent clocks counted from different moments, which is why the order of actions matters more than speed.
Not every one. Reporting to the UODO is the rule, from which one can only deviate based on a documented risk assessment for data subjects. The 72-hour deadline runs from becoming aware of the breach, and notifying data subjects is a separate decision.
