Discovering that someone has accessed your customer, employee or payment data without permission is one of the most pressured moments a business can face. The instinct is to fix everything at once, tell everyone at once, or say nothing until you know more. Each of those instincts can make the position worse. Machines that are switched off can lose evidence. Messages sent before the facts are checked can mislead the very people you need to help. Silence can miss a legal duty that started when you became aware. What works instead is a sequence. Contain the incident first, protect the evidence, establish what was taken, and only then work through who must be told and what they need to hear.
In short: what to do after a business data breach
After a business data breach, work through these six steps in order.
- Secure systems and take affected equipment offline without switching it off.
- Preserve evidence and mobilise the response team.
- Establish what data was taken and whose it is.
- Work out the notification duties that apply to you.
- Notify law enforcement, affected businesses and affected people as required.
- Fix the vulnerability and document everything.
The first hours: secure the operation
The first hours set the quality of everything that follows. Your aim is narrow: stop further loss, keep the evidence intact, and put named people in charge of the response. The Federal Trade Commission (FTC), in its Data Breach Response guide for business, puts the same point first: move quickly to secure your systems and fix vulnerabilities that may have caused the breach, because the only thing worse than one breach is a second one through the same opening. The FTC guide is official guidance, not law. It points you towards the laws that do apply, and this article treats it that way throughout.
Sequence matters inside those first hours. Containment comes before detailed investigation, and investigation comes before notification. A business that announces details it has not verified will have to correct them in public, which damages trust twice. A business that investigates slowly while systems stay exposed invites further loss. Work the steps in this section together, with the response team coordinating them, rather than treating them as a queue that one person works through alone.
Mobilise the response team and name one point person
Mobilise your breach response team right away. Depending on the size and nature of your business, the FTC suggests that team may need forensic, legal, information security, information technology, operations, human resources, communications and management input. A small business will not have all of those roles in house, which is exactly why the plan section at the end of this article asks you to name outside contacts before you need them. On the day, the team you can assemble quickly, with clear roles, beats a larger team that takes two days to gather.
Designate one point person for releasing information. That person holds the latest verified facts, approves anything said outside the business, and is the contact named in notifications. Everyone else routes questions to that person rather than answering from partial knowledge. This is not about controlling a message for its own sake. It is how you avoid three different accounts of the same incident reaching customers, regulators and the press, and how affected people get one consistent set of instructions about what to do next.
Consult legal counsel early, and consider outside counsel with privacy and data security experience if your usual adviser does not cover this ground. The legal questions in a breach, which duties apply, in which places, on what timetable, are the questions this article deliberately teaches you to work out rather than guess. Counsel helps you answer them for your facts. Interview the people who discovered the breach and anyone else who may know about it, and make sure customer facing staff know where to forward information that could aid the investigation, because useful facts often arrive first at a help desk or an inbox that nobody is watching.
Stop further loss: take affected equipment offline without switching it off or wiping it
Take all affected equipment offline immediately, but do not turn any machines off until forensic experts have assessed them. Disconnecting stops the intruder reaching the equipment and stops data leaving. Switching off can destroy volatile evidence held in memory and can make the forensic picture much harder to rebuild. Do not wipe, rebuild or restore affected machines in the first hours either, however strong the urge to get back to normal. A clean machine can be put online in place of an affected one where the business needs to keep operating.
Secure physical areas potentially related to the breach. Lock them, change access codes if needed, and ask your forensic experts and law enforcement when regular operations can reasonably resume in those areas. Update credentials and passwords for authorised users, and do this properly rather than selectively. If an attacker stole credentials, your system stays vulnerable until those credentials change, even after the attacker tools have been removed. Closely monitor entry and exit points, especially any involved in the breach, because an intruder who has lost one route in may test others.
Remove improperly posted information from the web. If personal information was exposed on your own website, take it down at once, and contact search engines so cached copies are not archived. Search for your exposed data elsewhere online as well, and contact any site that has saved a copy and ask for its removal. This step is easy to forget while servers dominate attention, yet a public web page can expose more people, faster, than the original intrusion did.
Preserve evidence for the forensic investigation
Do not destroy evidence in the course of your investigation or your remediation. Forensic investigators will capture images of affected systems, collect and analyse evidence, and outline the steps needed to fix the problem. Logs, access records, emails about the discovery, and the affected equipment itself all form part of that picture. Set a clear instruction across the business in the first hours: nobody deletes, tidies or rebuilds anything connected with the incident until the forensic team says it is safe to do so.
Document your investigation as you go. Record who found what, when they found it, what was decided, who decided it, and what was done. That record serves three purposes at once. It helps the forensic work, because times and sequences matter. It supports any notification you later make, because regulators and affected people will ask what happened and when you knew. And it creates the evidence that you responded promptly and carefully, which is a very different record from one reconstructed from memory weeks later.
Not every security incident is a personal data breach, and the distinction shapes your duties. A distributed denial of service attack, for example, aims at availability rather than at taking data, and our guide to how to mitigate a DDoS attack covers that response. Keep the categories separate in your record from the start: an attack on availability, an intrusion with no evidence that data was reached, and an incident where personal data was accessed or taken lead to different notification questions later.
Establish what happened: scope, data types, whose data, and whether exposure is ongoing
Once containment is under way, establish the facts the rest of the response depends on. What happened, and how did the intruder or the error get in. Which systems were reached. What types of information were compromised, for example names, contact details, account access information, payment data, health related information or employee records. Whose data it is: customers, employees, or data you hold for other businesses. How many people are affected, even if the first figure is an estimate that will be refined. And whether exposure is still ongoing, which changes the urgency of every other step.
Work with your forensic experts on the detail. Analyse backup or preserved data. Review logs to determine who had access to the data at the time of the breach, and who has access now, and restrict any access that is not needed. Find out whether protective measures such as encryption were enabled when the breach happened, because that fact can change both the risk to individuals and the notification analysis, particularly under the UK and EU rules covered later in this article. Verify the types of information compromised and the number of people affected, and check that you hold usable contact information for those people, because a duty to inform is hard to meet if your contact records are part of what was damaged.
Resist filling gaps with assumptions. A notification built on an understated scope will need a second, worse notification. A notification built on an overstated scope frightens people whose data was never involved and dilutes the instructions for those who genuinely need to act. Where a fact is not yet known, record it as not yet known, note who is establishing it, and keep the investigation resourced until the core questions, what data, whose data, and whether it is still exposed, have evidenced answers. Those three answers are the input to the notification sections that follow, and they are worth hours of work before any external message is drafted.
Fix the vulnerability: service providers, access rights, segmentation and information posted online
Fixing the vulnerability is related to containment but not identical to it. Containment stops this incident spreading. Fixing removes the opening it came through and checks the openings next to it. When you get the forensic reports, take the recommended remedial measures as soon as possible, and verify the fix rather than assuming it. If a supplier tells you a vulnerability on their side has been remedied, check that it really has been, in the same way you would check your own work.
Think about service providers directly. If providers were involved in the incident, or could reach the affected data, examine what personal information they can access and decide whether their access privileges need to change. Ensure providers are taking the steps needed so another breach does not occur through the same route. Many small businesses hold their most sensitive data inside other companies systems, payroll, accounting, customer databases and cloud storage, so a breach response that stops at your own office door misses where the data actually lives. Our guide to securing accounting software from cyberattacks covers the financial data side of that picture in detail.
Check your network segmentation with your forensic experts. Segmentation means a breach on one server or at one site should not lead automatically to a breach on another. Analyse whether your segmentation worked in this incident: did it contain the damage, or could the intruder move freely once inside. If changes are needed, make them now, while attention and budget are available. Review access rights across the affected systems at the same time. Accounts that no longer need access, former staff credentials, shared logins and broad administrator rights are common findings after a breach, and closing them is cheap, fast and provable progress.
Work out who must be told, before telling anyone
Determine your legal requirements before you notify. That ordering, which the FTC states explicitly, protects you in both directions. It stops you missing a duty with a clock attached to it, and it stops you sending a notice that a particular law requires to contain specific wording, or forbids from containing certain details, before you have read that law. The duties split sharply by place, so this article teaches them in two labelled sections. Nothing in the United States section should be read as a UK or EU rule, and nothing in the UK and EU section should be read as a United States rule. Sector rules can sit on top of either, and the end of this section flags where to check for them.
United States: state notification laws, and why there is no single national deadline
In the United States, breach notification legislation exists in all states, the District of Columbia, Puerto Rico and the Virgin Islands, requiring notification of security breaches involving personal information. That is the position stated in the FTC Data Breach Response guide, August 2023 edition (PDF), and it is as far as any general statement can safely go. Triggers, deadlines and required content vary by state. States define personal information differently, set different thresholds for when notification is required, allow different periods for giving it, require different content in the notice, and in some cases require notice to a state official or to credit reporting agencies as well as to individuals.
For that reason this article prints no single deadline for the United States, and you should distrust any general guide that does. Your task is specific: identify the states whose residents are affected, because duties usually follow the affected person rather than your office address, then check each relevant state law, or have counsel check it, for its trigger, its timetable and its content rules. Depending on the types of information involved, other federal laws or regulations may also apply to your situation, so check state and federal requirements together rather than assuming the state list is the whole answer.
United States: notifying law enforcement, affected businesses and the institutions that maintain accounts
Under the FTC framework, when your business experiences a data breach you notify law enforcement, other affected businesses and affected individuals. Notify law enforcement promptly: the FTC advises calling your local police department immediately, reporting the situation and the potential risk of identity theft, because the sooner law enforcement learns about the incident, the more effective it can be. If local police are not familiar with investigating information compromises, the guide points you to the local office of the FBI or the U.S. Secret Service, and to the U.S. Postal Inspection Service where mail theft is involved. Consult your law enforcement contact about the timing of individual notification, so your notice does not impede the investigation.
Notify affected businesses in two specific situations that businesses often miss. First, if account access information, such as credit card or bank account numbers, was stolen from you but you do not maintain the accounts, notify the institution that does maintain them, so it can monitor the accounts for fraudulent activity. Second, if you collect or store personal information for other businesses, notify those businesses of the breach. They have their own duties to their customers and regulators, and they cannot meet them if you stay silent. If Social Security numbers were stolen, the FTC also advises contacting the major credit bureaus for information and advice, and telling them if you are recommending that people request fraud alerts or credit freezes.
UK and EU: GDPR notification duties
Businesses handling the personal data of people in the UK or the EU sit under a different, codified regime. The EU rules are set out in the GDPR, and the UK applies its own UK GDPR, supervised in the UK by the Information Commissioner’s Office, known as the ICO. The European Commission guidance on business obligations summarises the breach duties, and the European Data Protection Board (EDPB) guidance on personal data breaches, including its Guidelines 9/2022 on personal data breach notification under the GDPR, explains how those duties apply in practice. UK readers should follow the ICO route described below rather than treating EU text as the UK process.
Under the GDPR, where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, the controller must notify the supervisory authority without undue delay and at the latest within 72 hours of becoming aware of the breach. Note every part of that sentence, because each part does work. It is the supervisory authority, not individuals, that this deadline concerns. It runs from becoming aware, not from when the breach originally happened. And it applies where the risk threshold is met: a breach unlikely to result in a risk does not have to be notified to the authority, although it must still be documented, and the decision not to notify must be one you can justify. If you cannot provide every required detail inside the period, information may be provided in phases without undue further delay, and a notification made late must be accompanied by reasons for the delay.
Two further GDPR duties complete the picture. A processor must notify the controller of a personal data breach without undue delay after becoming aware of it, so the controller can meet its own duties. And individuals must be informed without undue delay when the breach is likely to result in a high risk to their rights and freedoms, unless effective technical and organisational protective measures had been applied to the affected data and make that risk no longer likely, for example where the data was rendered unintelligible to unauthorised people, or unless subsequent measures ensure the high risk is no longer likely to materialise. The information a supervisory authority notification must contain includes a description of the nature of the breach with, where possible, the categories and approximate number of individuals and records concerned, the name and contact details of the data protection officer or other contact point, a description of the likely consequences, and a description of the measures taken or proposed to address the breach and mitigate its effects.
For the UK specifically, the ICO guide to personal data breaches states the same structure under the UK GDPR: report certain breaches to the ICO within 72 hours of becoming aware of them, where feasible, where a risk to individuals’ rights and freedoms is likely; inform affected individuals without undue delay where the risk is high; keep a record of every personal data breach whether or not it had to be reported; and use the ICO report a breach route to make the notification, with the ICO 72 hours guide for small organisations walking smaller businesses through the first steps, including starting the clock when you discover the breach and keeping a log from the outset. The UK and EU frameworks are closely aligned on breach notification, but they are separate legal regimes with separate regulators, and a business trading into both may need to consider both, with advice, rather than assuming one notification covers the other.
Finally, check whether a sector rule also applies, whichever country you are in. Health data can engage rules such as HIPAA and the FTC Health Breach Notification Rule in the United States, and payment card and financial services rules can add their own notification duties and timetables. This article does not teach those regimes. It flags them, as the FTC guide does, so you ask the question early, while the answer can still shape your timetable, instead of discovering a second, shorter clock after the first one has already run.
Writing the notification: what happened, what information, what you have done, what people can do
A good breach notification is factual, complete on the points the reader needs, and written in plain language at a stressful moment for the reader. The FTC structure, reflected in its model notification letter, is the reliable template in any regime, subject to any content a specific law requires or restricts. State your notification around these points. How the breach happened. What information was involved. How the information has been used, if you know. What you have done to remedy the situation. What you are doing to protect individuals, including any support you are offering. What affected people can do themselves, given the type of information exposed. And how to reach the relevant contacts in your organisation, led by your designated point person.
Build a communications plan around the letter rather than treating the letter as the whole job. The plan should reach every affected audience: employees, customers, investors, business partners and other stakeholders, through letters, a dedicated web page, and a phone route where the scale justifies it. Anticipate the questions people will ask and publish clear, plain language answers where they are easy to find. Good communication up front limits concern and frustration later, and it reduces the volume of confused individual contact your team has to handle during recovery.
Two disciplines protect you while you communicate. Do not make misleading statements about the breach, and do not withhold key details that might help people protect themselves and their information. At the same time, do not publicly share information that might put people at further risk, and check with your law enforcement contact about what to include so the notice does not hamper the investigation. Tell people how you will contact them in future about the breach, for example only by letter, or through updates posted on your website, because that single detail helps recipients spot phishing attempts that exploit breach news. Where financial information or Social Security numbers were exposed in a United States case, consider offering credit monitoring or other support such as identity theft protection or restoration services, and point people to the steps that match the data involved, rather than generic reassurance.
Recovery and record: documenting every step, supporting affected people, and closing the gaps
Recovery starts while notification is still under way. Support affected people with the specific steps their data type requires: password resets where credentials were exposed, fraud alerts and credit freezes where financial identifiers were involved in a United States case, and clear warnings about phishing where contact details were taken. Keep the point person and the published answers updated as facts firm up, and correct any earlier statement that the investigation has overtaken. A short, honest correction protects trust better than silence around a figure you now know was wrong.
Document everything, and keep documenting after the incident feels over. Your breach record should hold the facts of the incident, the scope findings, every notification decision including any decision not to notify and the reasoning behind it, copies of the notices sent, the remedial measures taken, and the dates each step happened. Under the GDPR frameworks described above, documenting every breach, notified or not, is itself a duty. Under every framework, the record is what lets you show a regulator, a customer or a court that decisions were taken promptly, on evidence, by named people.
Then close the gaps the breach exposed, formally rather than by good intention. Work through the forensic recommendations to completion and record each closure. Test the fixes: our guide to the types of penetration testing explains how structured testing can check whether the route the intruder used, and the routes next to it, are genuinely closed. Review the wider prevention picture against our guide to cyber security measures for businesses, and where the gaps are bigger than your internal skills, bring in outside help deliberately rather than in a panic. Our guide to locating quality cloud security consulting services covers how to choose that help well. The output of recovery should be a short, dated list of changes made, owners assigned and checks scheduled, not a feeling that lessons were learned.
The plan to write before it happens: response team, contacts, supplier list and draft notices
Every step in this article is faster, cheaper and calmer if it was prepared before an incident. A written breach response plan does not need to be long. It needs to exist, to be current, and to be findable at the moment of discovery, including outside office hours. At minimum it should name the response team and the point person, with deputies; list forensic, legal and communications contacts, with out of hours routes; list your key suppliers and service providers, what data each one can reach, and their incident contact details; and hold draft notification letters and regulator notification checklists that the team can adapt under pressure instead of drafting from a blank page.
Add a rehearsed first hours checklist drawn from this article: take affected equipment offline without switching it off, secure physical areas, change compromised credentials, preserve evidence, start the breach log, and begin the scope questions. Rehearse it once, even as a tabletop exercise where the team talks through an invented scenario for an hour, and you will find the gaps while they are still free to fix: the supplier whose contract has no incident clause, the administrator account nobody can reset, the customer contact list held in the very system the scenario takes offline. Review the plan whenever suppliers, systems or key staff change, and after every real incident, however small.
Preparedness also includes the duties that exist before any incident. The privacy notice you publish, the promises it makes about security, and the records you keep about where personal data lives all become response assets on the day of a breach, because they tell you what you hold and what you told people you would do. Our business website compliance checklist covers those standing duties, and working through it in a quiet month is the cheapest breach preparation most businesses will ever do.
A note before you act: this guide is general information, not legal advice
This article is general information for business readers, not legal advice. Deadlines, tests and duties depend on your jurisdiction, your business structure and your industry, so a qualified local adviser should check anything you are about to act on, especially notification decisions, where the timetable may already be running. The United States material in this article follows the FTC Data Breach Response guide, which is official guidance and not law, alongside the state notification laws it points to. The UK and EU material follows the GDPR frameworks as summarised by the European Commission, the EDPB and the ICO, and the regulator for your situation, not a general article, is the authority on whether your breach had to be reported.
With that qualification in place, keep the sequence. Secure the operation and take affected equipment offline without switching it off. Preserve the evidence and let the forensic work establish what data was taken and whose it is. Work out the notification duties that apply to you, in the places where the affected people are, before you notify. Then communicate clearly, fix the vulnerability properly, and write down everything you did. A business that follows that order gives affected people the best chance to protect themselves, gives regulators a response they can follow, and gives itself a record it will be glad to have.
Sources used for this article
- Federal Trade Commission, Data Breach Response: A Guide for Business (guide page): https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
- Federal Trade Commission, Data Breach Response: A Guide for Business, August 2023 edition (PDF): https://www.bulkorder.ftc.gov/sites/bulkorder.ftc.gov/files/publications/560a_data_breach_response_guide_for_business_aug2023-508_0.pdf
- European Commission, Obligations under data protection law, including the section on notifying data breaches: https://commission.europa.eu/law/law-topic/data-protection/information-business-and-organisations/obligations_en
- European Data Protection Board, Personal data breaches (guidance hub): https://www.edpb.europa.eu/topics/security-data-breaches/personal-data-breaches_en
- European Data Protection Board, Guidelines 9/2022 on personal data breach notification under the GDPR: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en
- UK Information Commissioner’s Office, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
- UK Information Commissioner’s Office, Report a breach (personal data breach route): https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/
- UK Information Commissioner’s Office, 72 hours: how to respond to a personal data breach (small organisations): https://ico.org.uk/for-organisations/advice-for-small-organisations/personal-data-breaches/72-hours-how-to-respond-to-a-personal-data-breach/
Frequently asked questions
What is the first thing a business should do after discovering a data breach?
Secure the operation. Take affected equipment offline to stop further loss, secure related physical areas, change compromised credentials, and mobilise the response team under one named point person, while preserving evidence for forensic assessment.
Should you switch off computers affected by a breach?
No. Take affected equipment offline, but do not switch machines off or wipe them until forensic experts have assessed them, because switching off can destroy evidence the investigation needs.
Who does a business have to notify after a data breach?
It depends on the regime and the facts. Under the United States framework, businesses notify law enforcement, affected businesses and affected individuals as required by the applicable state laws. Under the GDPR frameworks, controllers notify the supervisory authority where the risk threshold is met and inform individuals where the risk is high.
Is there a 72-hour deadline to report a data breach?
Only in the UK and EU under the GDPR, where a controller must notify the supervisory authority without undue delay and at the latest within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to individuals’ rights and freedoms. United States state laws set their own triggers, deadlines and content requirements, with no single national deadline.
What should a breach notification to customers include?
How the breach happened, what information was involved, how the information has been used if known, what you have done and are doing in response, what affected people can do to protect themselves, and how to reach the contact person for the breach.
What should a business prepare before a breach happens?
A written response plan naming the response team and point person, forensic and legal contacts, a supplier list showing what data each supplier can reach, draft notification letters, and a rehearsed first hours checklist covering containment and evidence preservation.
