Sooner or later, most organisations have a security incident. A stolen laptop, a phishing email someone opened, a login nobody recognises, a breach at a supplier. How you act in the first few hours decides whether the consequences stay manageable or escalate.
The GDPR requires you to report a personal data breach to IMY, the Swedish data protection authority, within 72 hours of becoming aware of it, where the breach is likely to pose a risk to the people whose data it is. That is a tight deadline, and it assumes you already know what to do and who does it. Where incident readiness fits into your wider data protection work is set out in our GDPR guide for smaller companies.
Here is a simple flow that works for a smaller company. If NIS2 also applies to you the deadlines are tighter still, and we cover those in the guide to the Cybersecurity Act.
Step 1: identify and contain (0 to 2 hours)
As soon as a suspected incident is reported, one named person takes charge. That has to be decided in advance, not in the moment.
The first move is containment: limit the damage and stop it spreading. That might mean disabling an account, taking a device off the network, or calling a supplier.
Write down what happened, when it was discovered, and who knows about it.
Step 2: assess how serious it is (2 to 8 hours)
Not every security incident has to be reported. You need to judge: has personal data been exposed, altered or lost? Which categories of data? How many people are affected? What is the likely risk to them?
Special category data, health information, financial details, personal identity numbers, weighs heavier. Encrypted data where nobody had the key weighs lighter.
If the assessment is unclear, call your legal adviser. Reporting unnecessarily is better than missing a reporting duty.
Step 3: report if you have to (within 72 hours)
If the incident is judged to pose a risk to individuals, notify IMY through their online service. The notification should include:
- a description of the nature of the breach
- the categories and approximate number of people and records affected
- the likely consequences
- the measures taken or planned
If you cannot gather everything within 72 hours, report anyway with what you have and supplement it afterwards. IMY accepts that.
Step 4: tell the people affected (where the risk is high)
Where the breach is likely to pose a high risk to the individuals, not merely a risk, you also have to tell them directly. That means a clear message about what has happened, which data is involved and what they can do to protect themselves.
There are exceptions: where the data was encrypted and inaccessible, where you have taken measures that remove the risk, or where individual notice would take disproportionate effort, with very large datasets and no contact details, for instance.
Step 5: document it and learn (afterwards)
Whether or not the incident had to be reported, document it internally. The GDPR requires you to keep a record of all breaches, including the ones you did not report and why.
Hold a short review afterwards: what happened, how did we act, what would we do better? This is not a project. Thirty minutes with the right people is enough.
The document to have ready before it happens
Write a simple one-pager with:
- who takes charge in an incident (name, phone number)
- contact details for IMY and for your lawyer
- a checklist of the five steps above
- a template for documenting the incident internally
Put it somewhere every manager knows to look. Then hope you never need it.
Want to see whether the rest of your basic protection is in place? Take our Compliance Health Check.
