A cyberattack involves more than operational disruption. When personal data is affected, an organisation must also assess consequences for individuals and coordinate its response. The DPO, where appointed, security teams, management and communications teams need prepared arrangements.
A personal data breach is not limited to a leak
CNIL explains that a breach can involve destruction, loss, alteration, unauthorised disclosure of or access to personal data. Preparation should therefore consider availability and integrity as well as confidentiality. Source: CNIL, “Security: managing incidents and breaches”, 2024 security guide, accessed 15 October 2026 (French).
Separate documentation from notification decisions
Breaches must be documented internally. Where a breach poses a risk to individuals’ rights and freedoms, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Informing affected individuals involves a high-risk threshold, subject to GDPR exceptions. Source: CNIL, “Notify a personal data breach”, published 24 May 2018, accessed 15 October 2026 (French).
Prepare coordination before an incident
Build a scenario with the people involved and check:
- Contact details for the DPO or other contact point, security leads, business owners and providers
- The channel to use if normal email is unavailable or cannot be trusted
- Where procedures and information needed for assessment are kept
- Responsibilities for establishing facts, assessing risks, approving messages and tracking decisions
- How confirmed facts, uncertainties, times and response measures are recorded
Use an exercise to test information flow
Simulate an email outage when a breach is suspected. Can the right people be reached? Does the designated contact have the information required? Are decisions shared with the correct recipients? Use fictional data to test coordination without exposing real records.
Where does Shadline fit?
Shadline provides communications and access to essential documents in an environment independent of normal tools. It can support coordination between the teams involved. Your organisation must define the data scope, access rights and procedures.
Legal assessment, risk evaluation and notification decisions remain with the responsible people. Shadline does not perform these steps automatically and does not, by itself, establish GDPR compliance.
Connect NIS2 and GDPR preparation
The objectives differ, but people and coordination arrangements may overlap. A joint exercise can check who manages operational impacts, who assesses consequences for personal data and how information is shared. See also our article on NIS2 and business continuity.
Regulatory preparation: NIS2 and business continuity · GDPR and personal data breaches