Breaches likely to result in a risk to people must be reported to IMY within 72 hours of becoming aware. You can report in stages if you do not have all the facts. A late report must explain the delay.
Why it matters
For GDPR, notify imy is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Know who decides to report
- Prepare the facts IMY asks for
- Send a first report even if it is incomplete
Where to start
Awareness starts when you are reasonably certain a breach has happened. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.