Decoding the 72-Hour GDPR Doomsday Clock

Decoding the 72-Hour GDPR Doomsday Clock

The GDPR 72-hour reporting requirement has notable similarities to the insane ultra-marathons elite athletes run in the same time period. The 72-hour time limit requires companies to cover ground they’d typically take weeks or even months to traverse—kind of like running more than 300 miles in three days.

With data stored in unexpected places, that 72 hours can get eaten up quickly in trying to sort through where compromised data is stored. But with a robust endpoint visibility tool, which allows a response team to see the content of endpoint data clearly, the GDPR clock doesn’t have to spell doom.

What should you do if you discover a data breach?

Round up your response team. Depending on the size of your business, your data breach response team may include several dedicated personnel in addition to other key company stakeholders, or it may be a few individuals who do this along with their other duties.

Gather key information. Figure out what happened, what was the cause of the breach, and what type of data was compromised. This step is where companies that don’t have an endpoint visibility tool will see precious hours of their GDPR clock tick away as they try to determine what data was compromised. An endpoint visibility tool that provides clarity on the content of data will answer that question with confidence.

What if no personal information was compromised?

If, after using an endpoint visibility tool or another assessment process, you ascertain that no GDPR-regulated data was involved, breathe a sigh of relief. You don’t need to notify the GDPR authorities. You should, however, continue through your plan: clean up the data breach, close the holes that caused it, and notify any impacted customers.

What if GDPR-regulated data was affected?

Then the clock retroactively starts ticking from the moment you first discovered the data breach, and you notify the GDPR authorities. When you alert the regulators, it’s best to have all your ducks in a row. If you can tell the authorities exactly what happened, who was involved and your plan to remediate it, you will be better positioned to resolve the issues. An endpoint visibility tool will provide you with the information necessary to make reporting to the authorities a much smoother step.

What happens after GDPR authorities are alerted?

You continue the process of cleaning up, plugging the holes, and notifying the consumers affected by the breach. So far, the GDPR authorities have only specified that consumer notification happens “without reasonable delay.”

A data breach is always fraught with uncertainties, which is part of why companies typically take a long time to sort through the details and make public statements. With GDPR, companies no longer have the luxury of time, so it’s important to remove as much uncertainty as possible from the situation, to gain clarity quickly. An endpoint visibility tool can help speed up the process and provide confidence in a company’s findings after a breach.

There’s no way around it: the aftermath of a data breach with GDPR-regulated data will feel like a marathon. Having an endpoint visibility tool in place before the breach happens is like cutting that 300 miles down to a much more manageable 26.2 miles. It’s still a race you need to prepare for, but it’s a far more sane and feasible experience.