Incident management and incident response: the DPO's guide
Incident management and incident response allow you to detect, contain, and eradicate a threat, then notify authorities within very tight deadlines: 72 hours to report a personal data breach to the CNIL under the GDPR, and immediately for a serious high-risk AI incident under the AI Act. An incident response plan must be prepared before the attack occurs.
The essentials
- A personal data breach that poses a risk to the rights and freedoms of individuals must be notified to the CNIL within a maximum of 72 hours after becoming aware of it.
- The 72-hour countdown begins as soon as the data controller becomes aware of the breach, not at the time of its technical resolution.
- If the risk to the affected individuals is high, the organization must also inform them individually and without undue delay.
- Article 33.5 of the GDPR requires all personal data breaches to be documented in an internal register, including those that were not notified to the CNIL.
- Under the AI Act, a serious incident involving a high-risk AI system must be reported immediately to the market surveillance authority, within a maximum of 15 days.
Ransomware paralyzes your HR servers. A configuration error exposes your customer database online. An artificial intelligence system drifts and discriminates against candidates during recruitment.
In the face of these situations, there is no room for improvisation. Incident management and incident response are no longer just technical concerns reserved for IT teams: they have become the central pillar of corporate regulatory compliance.
With the tightening of the European legal framework, particularly through the GDPR and the AI Act (the European Artificial Intelligence Regulation), organizations must be able to detect, contain, and notify security breaches within extremely tight deadlines. This practical guide explains how to structure a resilient incident response plan and how to unify GDPR and AI Act compliance without overloading teams.
What are incident management and incident response?
Incident management and incident response refer to all the actions that allow you to stop an attack, contain a security incident, and comply with the resulting regulatory obligations. Successful security incident management relies on a balance between technical excellence and regulatory mastery.
In the collective imagination, a security incident is sometimes perceived as a simple IT problem to be solved. However, the technical response is only the first line of defense: it allows you to stop the attack, contain the incident, and immediately reduce operational risk. This field action is inseparable from the legal and reputational issues managed by three key stakeholders:
- the DPO (Data Protection Officer);
- the CISO (Chief Information Security Officer);
- the General Counsel.
To drive this synergy between technical and legal teams, it is first necessary to distinguish between two fundamental concepts: a security incident and a personal data breach.
What is the difference between a security incident and a personal data breach?
- Security incident (broad sense) is any undesirable or unexpected event that compromises the availability, integrity, or confidentiality of an information system. Example: a server that is inaccessible due to a power outage.
- Personal data breach (GDPR sense) is a security incident that leads, accidentally or unlawfully, to the destruction, loss, alteration, or unauthorized disclosure of personal data. Example: the exfiltration of an employee payroll file by a cyberattacker.
All data breaches are security incidents, but not all security incidents are data breaches.
Example: incident response to a ransomware attack
Your company is the victim of a ransomware attack. Your client files are encrypted and potentially copied. This is where the synergy between technical and legal teams becomes critical:
- the IT security team attempts to isolate the infection to contain it;
- at the same time, the DPO immediately assesses the incident: is there a risk to the rights and freedoms of natural persons?
- if so, the notification process must be initiated.
To prevent these crises from paralyzing operations, companies must rely on solid GDPR compliance governance and management, capable of bridging the gap between technology and the law.
What are the 4 stages of an incident response plan?
An effective incident response plan follows 4 stages: detection and qualification of the incident by the CSIRT, containment and eradication of the threat, regulatory notification within legal deadlines, and finally, the post-incident review. An incident response plan cannot be designed on the day of the attack; it must be prepared in advance through a structured and systematic process.
1. Detection, qualification, and mobilization of the CSIRT
The alert can come from three sources:
- a monitoring tool (SIEM);
- an internal user;
- an external report.
Once an anomaly is detected, it must be qualified. This is the role of the CSIRT. The CSIRT (Computer Security Incident Response Team) is a team of cybersecurity experts dedicated to the management, analysis, and resolution of IT security incidents. Whether internal to the company or outsourced to a specialized provider, the CSIRT analyzes the nature of the attack and assesses its severity.
To act quickly, CSIRT experts rely on a pre-established incident playbook. The incident playbook is a standardized operational guide that details reflex actions based on the type of threat: phishing, denial of service, or account compromise.
2. Containing and eradicating the threat: cyber crisis management
The goal of the containment phase is to stop the bleeding. Cyber crisis management involves making decisions that can sometimes be heavy for the company's business operations:
- isolating infected machines from the rest of the network;
- revoking access for compromised accounts;
- temporarily cutting off certain external connections.
Once the threat is contained, the technical team proceeds with eradication:
- removing malicious software;
- applying necessary security patches;
- restoring systems from clean, verified backups.
3. Regulatory notification: the 72-hour GDPR deadline
Under the GDPR, time is the DPO's worst enemy. When a personal data breach is confirmed and poses a risk to the rights and freedoms of individuals, the organization has a legal obligation to notify the CNIL (or the competent supervisory authority) within a maximum of 72 hours after becoming aware of it.
The 72-hour countdown begins as soon as the data controller becomes aware of the breach, not at the time of its technical resolution.
Regulatory reminder: if the risk to the individuals concerned is classified as "high" (for example, theft of banking or health data), you must also inform them individually and without undue delay, so that they can take the necessary measures (changing passwords, increased vigilance against phishing).
To follow the incident notification procedure without panicking, it is essential to anticipate and be able to automate the data breach register, in order to centralize the history and supporting documents required by the regulator.
4. Post-incident: the feedback loop (Retex)
The post-incident review is the final stage of crisis management: the incident response process does not end once the crisis has passed. This review is mandatory and serves to:
- precisely document the incident, which is a GDPR requirement even if the breach was not reported to the CNIL;
- adjust the company's risk analysis (data protection impact assessment, DPIA;
- update security policies to close residual vulnerabilities.
Mandatory internal register: Article 33(5) of the GDPR requires that all personal data breaches be documented in an internal register maintained by the DPO, including those not notified to the supervisory authority, along with the justification for non-notification.
What incident notification obligations does the AI Act impose?
The AI Act imposes strict monitoring and notification requirements on providers and deployers of high-risk AI systems: a serious malfunction of an algorithm must be reported immediately to market surveillance authorities. Incident compliance therefore no longer stops at personal data alone.
The entry into force of the AI Act introduces a new dimension to security incident management. A serious malfunction of an AI system can lead to, for example:
- a violation of fundamental rights;
- a major impact on the health and safety of individuals;
- damage to critical infrastructure.
In these cases, the company must report the incident immediately to the market surveillance authorities.
Severity thresholds under Article 73 of the AI Act: the severity thresholds in Article 73 of the AI Act require special attention. An incident resulting in a violation of fundamental rights or harm to an individual's physical integrity must be reported without undue delay.
GDPR notification vs. AI Act notification: what are the differences?
Triggering event
- Under the GDPR (personal data): personal data breach (destruction, loss, unauthorized access).
- Under the AI Act (high-risk AI systems): serious incident (death, harm to health/safety, violation of fundamental rights, damage to infrastructure).
Maximum deadline
- Under GDPR: 72 hours after becoming aware of it.
- Under the AI Act: immediately (maximum 15 days, reduced to 2 days in the event of a widespread threat or life-threatening situation).
Recipient
- Under GDPR: data protection supervisory authority (e.g., CNIL).
- Under the AI Act: national market surveillance authority / AI Office.
Why unify the GDPR and AI Act incident notification procedure?
Rather than handling GDPR breaches and artificial intelligence failures separately, mature organizations structure a unified incident notification procedure. This cross-functional approach avoids silos and provides the DPO, CISO, and Compliance Officer with a 360° view of the company's technological risks.
To anticipate these major transformations, companies should rely on a structured approach to AI Act compliance.
How does compliance software secure incident response?
GDPR and AI compliance software secures incident response by centralizing incidents, guiding the drafting of notifications, and bringing together the DPO, CISO, legal department, and technical teams on a single platform.
Managing a cyber and regulatory crisis with scattered Excel spreadsheets, endless email chains, and handwritten notes is the best way to miss the 72-hour deadline and make methodological errors.
Using GDPR compliance softwareand or AI software like Adequacy helps professionalize and accelerate every step of the incident response plan:
- Centralization and traceability : record every incident, qualify it instantly using integrated decision trees, and maintain a history of actions taken (ideal in the event of a CNIL audit).
- Guided notification generation : step-by-step guidance to ensure you provide all the information required by regulatory authorities without missing a thing.
- Simplified collaboration : enable real-time interaction between the DPO, CISO, legal department, and technical teams on a single, highly secure platform.
- Ready-to-use playbooks : standardize your remediation processes so every stakeholder knows exactly what to do, reducing collective stress and the risk of human error.
Incident management and incident response: what you need to know
Incident management and response rely on a pre-established plan that coordinates technical response (detection, containment, eradication) with regulatory obligations (notification, documentation). For the DPO, the challenge is to qualify the incident immediately, notify the CNIL within 72 hours if the breach poses a risk, report serious high-risk AI incidents under the AI Act, and log every breach in the internal register. A unified incident notification procedure for both GDPR and the AI Act prevents silos between teams.
FAQ - Incident management and incident response
What is the difference between a security incident and a data breach?
A security incident is a suspicious event that compromises the confidentiality, integrity, or availability of an information system (e.g., an inaccessible server). A data breach is a security incident that specifically affects personal data (e.g., a customer data leak). All data breaches are security incidents, but not all security incidents are data breaches.
What is a CSIRT?
A CSIRT (Computer Security Incident Response Team) is a team of cybersecurity experts dedicated to managing, analyzing, and resolving IT security incidents. The role of the CSIRT is to quickly contain attacks and help the company restore its systems securely. A CSIRT can be internal to the company or outsourced to a specialized provider.
What is an incident playbook?
An incident playbook is a standardized operational guide that describes the step-by-step actions to be taken by technical, legal, and communication teams in the event of a specific type of attack (e.g., ransomware, phishing). The incident playbook ensures a rapid response that complies with GDPR and AI Act requirements.
What is the deadline for notifying the CNIL of a data breach?
The maximum time allowed to notify the CNIL of a personal data breach is 72 hours after becoming aware of it, provided the breach poses a risk to the rights and freedoms of individuals. The countdown begins as soon as the data controller becomes aware of the breach, not when it is technically resolved.
Must a data breach that is not notified to the CNIL be documented?
Yes. Article 33(5) of the GDPR requires all personal data breaches to be documented in an internal register, including those not notified to the CNIL. For every non-notified breach, the register must explain the reason for non-notification. The register centralizes the history and supporting documents required by the regulator.
What is the deadline for reporting a serious AI incident under the AI Act?
Under the AI Act, a serious incident involving a high-risk AI system must be reported to the national market surveillance authority immediately, and no later than 15 days. This deadline is reduced to 2 days in the event of a widespread threat or a threat to life. A serious incident may involve a fatality, harm to health or safety, a violation of fundamental rights, or damage to infrastructure.
