Client data breach: what to do in the first 72 hours

At 11:47 on a Tuesday morning, a partner at a 22-person accounting firm receives a call from a client asking why their accountant’s email address just sent them a link to a Google Drive folder they don’t recognise. The partner opens their own email and sees the same outbound message — sent to 340 contacts — from an account they didn’t touch. The email contains a phishing link. The account has been compromised.

This is the moment the 72-hour clock starts. Not when IT finishes the forensic review. Not when the partner finishes the call. Not when the full scope of the breach is understood. Under GDPR Article 33, the clock begins at the point of awareness — and the obligation to notify your supervisory data protection authority within 72 hours is non-negotiable unless you can demonstrate that the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

For most professional services firms — accountants, lawyers, financial advisers, HR consultancies — a compromised email account almost certainly qualifies. Client names, financial positions, legal matters, and personal correspondence are exactly the categories of data that regulators consider high risk. The question is not whether you need to act. The question is how to act correctly under time pressure, with incomplete information, while simultaneously managing client relationships and attempting to contain the underlying incident.

This guide gives you a concrete, hour-by-hour framework for the first 72 hours. It is not a substitute for legal counsel — engage your DPO or data protection solicitor immediately — but it is a practical starting point for firms that have never navigated a breach response before.

Hours 0–4: Contain and assess

The instinct in the first minutes of a breach discovery is to start fixing things. Resist it. Remediation that destroys evidence can be as damaging as the breach itself, particularly if you later need to demonstrate to a regulator what happened and what was affected. The goal of the first four hours is not to fix the problem — it is to stop the bleeding while preserving everything you will need later.

Hours 4–24: Notify leadership, engage legal, preserve evidence

By hour 4 you should have basic containment in place and a preliminary scope assessment. The next phase is about getting the right people informed and building the formal record that will underpin your regulatory notification. This phase is as much about documentation discipline as it is about technical investigation.

Formally declare the incident in writing. Send an internal notification to senior leadership and your legal team that states: the date and time the incident was discovered, who discovered it, the preliminary scope assessment, the containment actions taken so far, and the names of the people assigned to the response. This email or document becomes the start of your incident timeline — a contemporaneous record that regulators will request and that demonstrates you took the matter seriously from the moment of discovery.

Your legal counsel or DPO will need to make a formal determination: does this breach require notification to the supervisory authority under GDPR Article 33? The test is whether the breach is “likely to result in a risk to the rights and freedoms of natural persons.” In practice, for professional services firms, any breach involving client personal data — names, financial details, matter references, correspondence — will meet this threshold. Assume notification is required until your legal adviser confirms otherwise.

Continue your technical investigation in parallel. The goal is to answer: How did the attacker gain access? What is the full scope of data potentially accessed or exfiltrated? Is the attacker still present in your environment? The answers will form the core of your supervisory authority notification. Document every finding as you go, with timestamps. Create a running incident log — a shared document that all response team members update in real time with what they discovered, when, and what action was taken.

Hours 24–48: Regulatory notification under GDPR Article 33

GDPR Article 33 requires notification to your supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it.” The critical word is “feasible.” The regulation explicitly acknowledges that you may not have complete information within 72 hours, and it allows for phased notification: you notify within 72 hours with what you know, and you supplement with additional information as the investigation progresses.

This means you should not wait until the investigation is complete before filing. An incomplete notification submitted within 72 hours is far better than a complete notification submitted at hour 80. Regulators understand that investigations take time. What they do not accept is using incomplete information as a reason to delay filing.

The Article 33 notification must contain, to the extent possible:

• The nature of the breach, including categories and approximate number of individuals concerned and personal data records concerned
• The name and contact details of your Data Protection Officer or other contact point
• The likely consequences of the breach
• The measures taken or proposed to address the breach, including where appropriate measures to mitigate its possible adverse effects

Most EU supervisory authorities — the ICO in the UK, the DPC in Ireland, the BfDI in Germany, Datatilsynet in Norway — have online notification portals. In the UK, the ICO’s breach report form is available at ico.org.uk and takes approximately 30–45 minutes to complete. File in the jurisdiction where your organisation is established, or where your affected clients are based if you operate across borders.

After filing, your supervisory authority may contact you with follow-up questions or request a supplementary report. Respond promptly. Regulators distinguish between organisations that engage cooperatively and those that are evasive — the former consistently receive more favourable outcomes in enforcement decisions.

Hours 48–72: Client communication and remediation plan

GDPR Article 34 requires you to notify affected individuals “without undue delay” when the breach is likely to result in a high risk to their rights and freedoms. This is a higher threshold than the supervisory authority notification — not every notifiable breach requires individual notification — but for most professional services breaches involving client personal data, the threshold will be met.

Your legal adviser will confirm whether individual notification is required. If it is, the notification to affected clients must describe in clear and plain language: the nature of the breach, the name and contact details of your DPO or contact point, the likely consequences of the breach, and the measures taken or proposed to address it and mitigate adverse effects. It must not minimise the incident, make promises you cannot keep, or request any action from the client that is not genuinely necessary.

Alongside client communication, publish your remediation plan internally and communicate it to your supervisory authority as a supplement to your original notification. The remediation plan should address the root cause: if the breach was caused by credential phishing, the plan should include MFA enforcement, phishing simulation training, and a review of email security controls. Vague commitments to “improve security” are not sufficient — regulators want to see specific, time-bound actions.

After 72 hours: The post-incident phase

Once the immediate response window closes, the work does not stop — it shifts. You enter a phase of ongoing investigation, supplementary regulatory reporting, and internal process improvement. Most supervisory authorities expect a final incident report within 30 days, even if you have been communicating throughout. Begin drafting this report at the end of the 72-hour window, incorporating everything you have learned.

Conduct a post-incident review with your full response team within five business days. The review should assess not just what happened technically but how the response process performed. Were the right people notified quickly enough? Did the incident log capture everything needed? Was the supervisory authority notification filed on time? Were clients notified with the right level of detail and care? Each gap in the response process is a process improvement item for your updated incident response plan.

The firms that handle breach response most effectively are not those that never have breaches — they are those that have invested in the infrastructure to detect, contain, document, and report incidents before an incident occurs. That infrastructure includes a documented incident response plan with assigned roles, an audit trail system that captures user activity in real time, a reliable log retention policy, and DPA agreements already in place with all vendors who process personal data. When the 11:47 Tuesday morning call comes, the firms with that infrastructure spend their first four hours responding. The firms without it spend their first four hours searching for information they should already have had.