When a breach is discovered by a customer: what to do first
By Rasa Tumenaite
A customer who reports a suspected breach has started a clock your organisation does not control. The first task is not investigation. It is containment, a written record of what the customer said, and an immediate check of which notification duty has already begun to run. Everything else follows in a fixed order, not in whichever order feels most urgent at the time.
What actually happened, in legal terms
A report from a customer is not proof that a breach occurred. It is proof that your organisation is now aware of a possible one. Awareness, not confirmation and not the underlying technical cause, is the trigger that most data protection regimes use to start their notification clocks. The exact deadline and the form of the notice are set by the applicable data protection regime and published by the relevant supervisory authority. This page does not name a specific figure, because the underlying register entry for this jurisdiction has not been completed, and an invented number would be worse than none.
Where the affected system also falls within the scope of network and information security law, a second, parallel clock can start under Directive (EU) 2022/2555 (NIS2). NIS2 sets baseline security and incident-notification expectations for entities it classifies as essential or important. The specific duty in a given case follows from the national law that transposes the directive, not from the directive text itself. Two clocks running from two different triggers is the normal state of affairs, not a sign that something has already gone wrong with your process.
What changes once the customer has told you
Before the report, the incident was internal and the timeline was yours to set. After it, three things change at once. The organisation is on notice, so silence is no longer a neutral option. Regulatory deadlines, once triggered, tend to run in calendar days or even hours, not in business days. And the customer's own contract may carry a separate notice duty that runs faster than either public regime.
If the customer relationship includes a signed security addendum, its own notification clauses can run in parallel with the statutory ones, and often on a shorter timer than either allows. When a security addendum arrives with the order form sets out how that document is read once it is already in force.
What to do first
- Log the report verbatim. Record the customer's exact words, the channel, the time, and the name of whoever took the call. The compliance lead owns this record from the first minute, and it does not get tidied up later.
- Contain, do not fix. The technical team isolates the affected system without altering logs. A full remediation carried out before the facts are captured tends to destroy the evidence a regulator will later ask for.
- Open the notification-clock check. The data protection lead confirms, within hours rather than days, whether personal data is plausibly involved and whether the organisation falls within scope of a parallel cybersecurity regime.
- Brief decision-makers, not the whole company. A short, factual note goes to the board or managing director. Wide internal circulation before the facts settle tends to create inconsistent accounts later on.
- Hold the customer communication until the facts are checked. A premature apology or an early admission can fix a legal position that the investigation has not yet confirmed.
- Instruct counsel on privilege before the file grows. Everything written after this point should be drafted on the assumption that a regulator or a court may read it later.
If the same incident also touches a licence or a royalty stream running under a separate agreement, the underlying reporting duty follows a different logic entirely. When royalties are underreported and the deadline walks through that duty on its own terms, and it should not be merged into the breach file by mistake.
Who decides, and on what evidence
No single person decides whether an incident is reportable. The organisation decides, on the record its own team has built, and the supervisory authority reviews that decision afterwards, not before. A regulator who later disagrees with the internal assessment does not ask why the call was made. It asks what evidence the call was made on.
| Signal | Who assesses it first | Typical horizon |
|---|---|---|
| Personal data plausibly involved | Data protection lead, with counsel | Hours, not days |
| Entity falls within NIS2 scope | Security lead, with counsel | Runs in parallel with the data protection clock |
| Contractual notice duty in the customer agreement | Account owner, with counsel | Set by the contract, often shorter than either statutory clock |
| Cross-border element, more than one member state involved | Counsel, choosing the lead authority | Adds a jurisdiction step before any notice goes out |
A warning that arrives from a third party asserting a right over the affected material, rather than a customer reporting a fault, is a different situation with a different first move. That sequence is set out separately in What to do first in this situation and what the recipient should avoid doing before advice is taken.
If your situation differs
If the breach affects data belonging to several customers across more than one member state, the assessment does not run under a single supervisory authority by default. Counsel identifies the lead authority before any notice is drafted, and the timeline changes once that step is added.
If the affected infrastructure sits outside the customer relationship entirely, for instance where the same systems also process a tokenised asset, the classification question is separate from the breach itself and should not be answered on this page. When a token is classified differently than expected is the document for that separate question.
If the customer withdraws the report, or asks that it not be escalated further, the organisation's own duty does not disappear with the request. A report that has already created awareness cannot be un-reported by the person who made it.
What this page does not decide
This page does not tell you whether the incident meets the threshold for a formal notice. That judgement depends on facts this page cannot see, and it changes with every new detail the investigation surfaces. It does not fix the technical cause, draft the notice itself, or set out what the work costs; the factors that drive cost and the shape of the engagement sit in a separate part of this site, not in this legal analysis. It does not replace the record your own team builds in the first hours. Nothing here is a substitute for that file.
Sources checked
Reviewed and current as of 10 March 2025. The cybersecurity notification framework referenced above is Directive (EU) 2022/2555 (NIS2), as published by the European Commission on its NIS2 policy pages. No article number, deadline figure, or fee is stated on this page, because the underlying register entry for the jurisdiction in question has not yet been completed. Where that is the case, the page describes the mechanism rather than a number it cannot verify.
Related situations
A different trigger, the same category of urgency: When a transfer mechanism is questioned in practice covers what happens when the question is not a breach at all, but the legal basis for moving the data in the first place.
FAQ
What is the first step when a breach is discovered by a customer?
Log the customer's report exactly as given, contain the affected system without altering logs, and open the internal check for which notification clock has started. Do this before any customer-facing reply is drafted, let alone sent.
Which deadline is already running?
At least one deadline starts the moment your organisation becomes aware of a possible breach, not the moment it is confirmed. The precise length of that deadline and the form of the notice are set by the applicable data protection regime and published by the relevant authority. Where a cybersecurity regime such as Directive (EU) 2022/2555 (NIS2) also applies, a second clock can run in parallel under the national law that implements it.
Who decides, and on what evidence?
The organisation decides, based on the record its own team assembles in the first hours. A supervisory authority reviews that decision afterwards, against the evidence the organisation kept, not against the outcome the organisation hoped for.
Before you reply to the customer
A short review of the file, carried out before anything goes out to the customer or a regulator, is usually the difference between a controlled notice and a defensive one. Have the sequence checked against the evidence you already hold before the first reply is sent.