When a breach is discovered by a customer: what it costs to be wrong
When a customer reports a breach, two clocks are already running: the regulatory notification clock and your own credibility with that customer. Getting the scope, cause, or timing wrong costs more than the breach itself, because it turns a security incident into a disclosure failure — and disclosure failures are judged by the paper trail, not by intent.
Basis
For organisations within the scope of When a transfer mechanism is questioned: what it costs as a related exposure, the same incident can raise a separate question about cross-border data flows. Setting that aside, Directive (EU) 2022/2555 (NIS2) imposes a duty on essential and important entities to notify the competent authority once an incident is classified as significant, with an early warning followed by a fuller report at a later stage. For organisations outside that scope, the wider data protection framework applicable to personal data still imposes a notification duty toward the supervisory authority and, in some cases, toward the affected individuals. The precise deadline and the threshold that triggers it are set out in that framework itself. They are not repeated here, because the figure that applies on day one differs from the figure that applies later, and a partial number is worse than no number.
Practical consequence
A customer report changes the starting point of every deadline that follows. The organisation's own "date of awareness" is now anchored to that report, not to whenever internal logs are reviewed. Three elements decide how expensive the error is: the scope you state, the cause you assert, and the timing you record.
| Element stated wrong | What it costs |
|---|---|
| Scope (which records, how many) | A second, corrective notification; the authority treats the first one as unreliable |
| Cause (technical vs human) | Loss of the argument that mitigating steps were reasonable given what was known at the time |
| Timing (date of awareness) | The notification deadline is recalculated from the earlier date, not the later one |
| Communication to the customer | A promise made before facts are confirmed becomes a separate dispute in its own right |
What to do
- The internal owner of the incident freezes the affected system's state before further changes are made, and logs every action with a timestamp.
- The person who investigates the technical facts is not the person who drafts the customer-facing message; keep the two functions apart.
- The organisation records, in writing, the moment it became aware of the breach — not the moment the breach itself occurred.
- The notification decision is routed to the person authorised to sign it, typically the data protection officer or the security lead, not to whoever happens to be available.
- A holding statement to the customer describes only confirmed facts and states plainly what is still under investigation.
- If the affected system falls within the scope of Directive (EU) 2022/2555 (NIS2), that notification is logged separately from any personal data notification, because the two duties run on different tracks.
Who decides
The supervisory authority for personal data decides whether the notification it received is adequate and timely. The competent authority under NIS2 decides, separately, whether a significant incident was reported within the required stages. Neither authority accepts a single combined filing as satisfying both duties; each is judged on its own record. Internally, the person who signs the notification should be the person with authority to bind the organisation on that filing, not the most senior person physically present when the customer called.
Where it forks
If the breach affects personal data only, the data protection framework governs the notification and the NIS2 duty does not arise. If the organisation is an essential or important entity and the incident is classified as significant, both duties can run in parallel, on separate clocks, with separate owners. If the affected asset is a licensed system that has itself been pledged as security — When a licence is used as security explained — the notification duty does not shift, but the secured party's consent rights over that asset may need separate handling. If the organisation is already contesting an earlier finding from the same authority — When the deadline for appeal has started and its own clock is running — that appeal deadline is independent of the breach notification deadline and does not pause it.
If the customer's contract includes a security addendum agreed at signing — A security addendum arrives with the order form technology — check whether that addendum sets its own contractual notification window, which can be shorter than the statutory one and runs regardless of it. If the affected system also processes tokenised assets, the question of which regulator has jurisdiction over the incident may depend on how that asset is classified — see When a token is classified differently than expected — and that classification question should be resolved before, not after, the notification is drafted.
What this page does not resolve
This page does not calculate the exact deadline that applies to a specific incident; that calculation depends on facts this page cannot see. It does not replace a forensic investigation of the breach itself, and it does not address criminal exposure that may arise separately from how the breach occurred. Where a contract or an insurance policy sets its own notification terms, those terms are read alongside this page, not instead of it.
Verified
Checked against: Directive (EU) 2022/2555 (NIS2), source: the European Commission's NIS2 policy page. The wider data protection notification duty referenced above is described at the level of mechanism, not of specific article or deadline, because the applicable national implementing record for that duty is not yet confirmed in this file.
Related publications
See also When a transfer mechanism is questioned: what it costs for a related question that can surface alongside the same incident.
FAQ
What is the first step when a breach is discovered by a customer?
Freeze the affected system's state, assign one internal owner, and start a written log of every step taken from that point forward, including the exact time the customer's report was received.
Which deadline is already running?
The notification deadline to the relevant authority starts from the organisation's date of awareness, which is the date of the customer's report, not the date the investigation confirms the details.
Who decides, and on what evidence?
The supervisory or competent authority decides, based on the written record of the notification, the timeline of awareness, and the steps taken between discovery and filing — not on the organisation's account of its own intentions.