When an incident touches several countries: what to do first
The first step is to freeze the facts before anyone drafts a notification. Log the moment the incident became known, list every country where systems or data subjects sit, and route the file to whoever owns notifications in each of those countries. Parallel notice to every relevant authority, sent early and updated later, beats a single polished notice sent late.
What sets the coordination in motion
Cross-border incidents in the EU sit inside a Union-level architecture, not inside a single national procedure. For network and information security incidents, that architecture is set out in Directive (EU) 2022/2555 (NIS2), which assumes that national single points of contact exchange information with each other rather than waiting for the affected organisation to choose one country and stop there.
Where the incident involves personal data rather than, or in addition to, network security, a separate cross-border mechanism applies under the general data protection regime. That mechanism is not anchored to a specific article in this material: the applicable national implementing rules differ by country, and citing a number here would outrun what this page can verify. What stays constant is the principle — one authority is not automatically the only authority, and silence towards the others is rarely a safe default.
What changes in practice once several countries are touched
Three things change compared with a single-country incident. First, the notification clock in most regimes starts from the moment the incident becomes known to the organisation, not from the moment it is confirmed or fully understood — waiting for certainty before writing to anyone is the most common self-inflicted delay. Second, a lead or coordinating authority may exist for your group structure, but it has to be identified, not assumed; assuming the wrong lead wastes the early hours that matter most. Third, internal communications multiply: legal, security, and client-facing teams each talk to a different audience, and contradictions between those audiences become evidence themselves.
What to do, in order
- Fix the scope. Legal counsel or the data protection lead lists every country where affected systems, data, or users are located, before anyone drafts a single sentence for a regulator.
- Freeze the timeline. The security lead records the exact moment of discovery, in writing, before remediation work overwrites logs that later prove when the clock started.
- Map the authorities. Legal counsel matches each affected country to its relevant supervisory or cybersecurity authority, and flags where a lead authority mechanism may apply.
- Notify in parallel. The organisation sends notice to each relevant authority at the same time, unless a lead authority has already been confirmed for the group; sequencing by guesswork is what produces missed deadlines.
- Preserve the evidence. The IT team secures logs, access records, and internal messages before systems are wiped or reconfigured, since the same file will later have to satisfy more than one authority.
- Align the internal message. One short internal brief goes to the board and client-facing staff, so that external statements from different countries do not contradict each other.
Who decides, and on what basis
| Situation | Who is approached first | What decides the lead |
|---|---|---|
| Same group, different national authorities already engaged | Each authority in the country where users or systems are affected | Location of the affected data subjects and systems, not the location of headquarters |
| Single controller, multiple establishments across the EU | The authority for the main establishment, with parallel notice to the others | Where the decisions on the affected processing are actually taken |
| Cybersecurity incident touching network and information systems | The national single point of contact for cybersecurity | The coordination architecture under Directive (EU) 2022/2555 (NIS2) |
None of these authorities decide on the basis of a press release. They decide on the basis of the timeline you froze in step two and the evidence you preserved in step five. A file that arrives with both survives scrutiny better than one that arrives with neither.
Where this overlaps with other files you may already have open
An incident rarely arrives alone. If the affected systems sit inside a contract that already outlives the product it was built for, the notification duty above runs alongside separate contract exposure — see When the contract term outlives the product in detail.
If control of the affected system is itself disputed between co-owners before any notice goes out, that dispute has to be resolved, or at least documented, before the notification can name a single controller — see When a co-owner refuses to sign explained.
If the affected technology is also the subject of an essentiality claim from a standards body, that claim does not pause the notification clock, and the two files have to run on separate tracks — see When a standard body claims your patent is essential.
If the incident coincides with a paused token issuance, treat the two deadlines as independent: the issuance pause has its own clock, and it does not extend the notification window — see When the issue is paused mid-sale and the deadline.
What this page does not settle
This page does not name the exact notification deadline for your case, because that number depends on which regime applies and on facts this material cannot see from the outside — the type of data, the sector, and the specific national implementing rules in each affected country. It also does not decide which authority is the lead for your group structure; that determination needs your actual corporate map, not a general situation page. Treat what is above as the sequence of moves, not as the finished notification.
Verified
Checked against Directive (EU) 2022/2555 (NIS2) as published by the European Commission's digital strategy portal. Where this page refers to data protection coordination without naming a specific instrument, that is deliberate: the applicable national implementing rules were not verified for this material and are not represented as verified.
Related situations
Once the first notices are out, the file usually turns towards how the receiving authority behaves — see When a supervisory authority sends a first request in.
Frequently asked questions
What is the first step when an incident touches several countries?
Fix the scope and freeze the timeline before drafting anything. List every affected country and record the exact moment the incident became known; both of those decisions are harder to make correctly after the fact than before it.
Which deadline is already running?
In most applicable regimes, the notification clock starts from the moment the organisation became aware of the incident, not from the moment it was confirmed or fully understood. The exact number of hours or days depends on the regime and country in question and is not stated here without a verified source.
Who decides, and on what evidence?
The relevant supervisory or cybersecurity authority in each affected country decides, based on the timeline the organisation recorded at discovery and the evidence preserved before remediation. A lead authority may apply where the group structure supports it, but that has to be confirmed, not assumed.