A time-stamped incident record and a documented notification decision for each relevant framework.
Notification clock reference
GDPR: awareness → risk assessment → authority notice without undue delay (where feasible within 72 hours). Singapore: expeditious assessment → notifiable determination → PDPC as soon as practicable (within three calendar days).
Educational reference only. Times stay in this page; no incident data is saved or sent.
STAGE 01
Contain without destroying evidence
Activate incident leadership, restrict exposed access and preserve logs. Record what happened, when it was detected and when awareness of a personal data breach was established. Consider confidentiality, integrity and availability: loss and destruction can matter even where no exfiltration is proven. Use authorised specialists and preserve chain of custody.
Evidence to keep: Incident owner; evidence locations; containment log.
STAGE 02
Map roles and affected people
Record data categories, sensitivity, volume, systems, likely consequences and affected groups. Assess your role per activity and obtain the supplier’s facts. A GDPR processor informs its controller without undue delay; do not wait for a completed forensic report before escalating. Keep uncertainty visible and update estimates.
Evidence to keep: Data and role map; supplier notifications; uncertainty register.
STAGE 03
Run parallel jurisdiction assessments
Build one row per applicable law with recipient, trigger, threshold, time limit and exceptions. GDPR authority notification is without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to rights and freedoms. High-risk breaches require communication to individuals without undue delay, subject to Article 34 exceptions.
Evidence to keep: Risk decision per jurisdiction; awareness time; competent authority.
STAGE 04
Determine the Singapore threshold
Where Singapore PDPA applies, assess reasonably and expeditiously. Notification to PDPC is required for significant harm or significant scale (500 or more affected individuals); the applicable data categories and exceptions matter. Notify PDPC as soon as practicable and no later than three calendar days after determining the breach is notifiable. Notification to individuals concerns significant harm, not scale alone, subject to exceptions. Intermediaries notify the engaging organisation without undue delay.
Evidence to keep: Assessment start; determination time; harm/scale rationale.
STAGE 05
Communicate and update
Do not invent a global 72-hour rule. US state laws may use different triggers, content rules and numerical thresholds; validate every affected state and relevant sector. Make regulator and individual communications factual and actionable. GDPR permits phased information where necessary; record delay reasons. Keep communications restricted to those who need them and avoid publishing identifiable case details.
Evidence to keep: Approved notices; submission receipts; next update time.
STAGE 06
Recover and learn
Document decisions even where notification is not required. Verify remediation and recovery, revise controls and rehearse the escalation path. Retain the case record under an approved schedule. This educational timeline is an orientation aid, not a determination that an actual incident is or is not notifiable.
Evidence to keep: Decision record; remediation evidence; retrospective actions.