Skip to content
Overlap

§ Incident clock

The incident clock

Something has gone wrong. Here is who you may have to tell, and by when. Enter when you became aware of it and answer two questions to see the deadlines. Nothing you type leaves your browser.

Pending · not yet law in IrelandThe NIS2 steps are not yet law in Ireland. See the Ireland tracker. The GDPR steps are law now.

1 When did you become aware of it?

The clocks start when you had reasonable certainty that something happened, not when it began. Your local time.

2 Is it a personal data breach?

Personal data lost, stolen, changed, destroyed, or seen or reached by someone who should not have it, by accident or on purpose (GDPR Art 4(12)).

3 Is your business an essential or important entity under NIS2?

Don’t know? Check whether NIS2 applies to you.

Next deadline

Times are worked out in your browser. Indicative only, not legal advice.

§ The first hour

The first hour

  1. Write down the time you became aware, and start a log of what you see and do, with times. Habit: Incident plan
  2. Get out the incident plan and call the person who leads on it. Habit: Incident plan
  3. Contain, don't destroy: disconnect affected devices from the network, but do not wipe or switch them off yet. You may need the evidence. Habit: Incident plan
  4. Call your IT supplier, and your insurer if you have cyber cover. Many policies need you to tell them early. Habit: Incident plan
  5. Decide, or note that you can't yet decide: is personal data involved, and could the incident be significant? Set the clocks below either way. Habit: Who to tell
  6. Find your list of who to tell, including the DPC, the NCSC and the Gardaí if a crime may be involved. Use a phone or device you trust if your email may be compromised. Habit: Who to tell

From the habits a written incident plan and knowing who to tell. Having both before anything happens is what makes the deadlines below realistic.

§ The timeline

Who to tell, and by when

NIS2 Directive, Article 23

Pending · not yet law in Ireland

Applies to essential and important entities under NIS2, for significant incidents.

Ireland has not yet passed its NIS2 law. These are the Directive's stages; the Irish law may add detail, and will name who you report to. The NCSC is expected to be the CSIRT.

Only a significant incident must be reported. Article 23(3) says an incident is significant if either of these is true.

The official text · Art 23(3)
it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned
it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage
Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(3)

  1. Early warning

    Pending · not yet law in Ireland

    Within 24 hours of becoming aware

    To: Your CSIRT or competent authority

    A short first alert. Say whether you suspect a crime or a malicious act, and whether other countries could be affected.

    The official text · Art 23(4)(a)
    without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact
    Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(4)(a)

  2. Incident notification

    Pending · not yet law in Ireland

    Within 72 hours of becoming aware

    To: Your CSIRT or competent authority

    Update the early warning and give a first assessment of how serious the incident is and what it affects, with any indicators of compromise you have.

    The official text · Art 23(4)(b)
    without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise
    Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(4)(b)

  3. Intermediate report

    Pending · not yet law in Ireland

    Only if the authority asks

    To: Your CSIRT or competent authority, if they ask

    Only if the authority asks for one. Keep a running record of what you know and do, so you can answer quickly.

    The official text · Art 23(4)(c)
    upon the request of a CSIRT or, where applicable, the competent authority, an intermediate report on relevant status updates
    Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(4)(c)

  4. Final report

    Pending · not yet law in Ireland

    Within one month of the incident notification

    To: Your CSIRT or competent authority

    One month after you sent the incident notification, not one month after the incident. Describe the incident in detail: how serious it was, the likely root cause, what you did and are still doing, and any cross-border impact. The time shown here assumes you notify at the 72-hour deadline; if you notify earlier, count one month from then.

    The official text · Art 23(4)(d)
    a final report not later than one month after the submission of the incident notification under point (b)
    Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(4)(d)

  5. Progress report, if still ongoing

    Pending · not yet law in Ireland

    If the incident is still ongoing when the final report is due

    To: Your CSIRT or competent authority

    If the incident is not over when the final report is due, send a progress report then. The final report follows within one month of the end of your handling of the incident.

    The official text · Art 23(4)(e)
    a progress report at that time and a final report within one month of their handling of the incident
    Directive (EU) 2022/2555, OJ L 333, 27.12.2022, Art 23(4)(e)

GDPR, Articles 33 and 34

In force

Applies to every personal data breach.

In Ireland the supervisory authority is the Data Protection Commission (DPC). The DPC's online breach form is on dataprotection.ie.

  1. Notify the Data Protection Commission

    Within 72 hours of becoming aware

    To: The Data Protection Commission

    Without undue delay and, where feasible, within 72 hours of becoming aware. You do not need to notify if the breach is unlikely to result in a risk to people. If in doubt, notify.

    The official text · Art 33(1)
    without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority
    unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons
    Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Art 33(1)

  2. Reasons for any delay

    Only if you notify after 72 hours

    To: The Data Protection Commission

    If you notify after 72 hours, say why. You can also send the information in stages if you do not have it all yet (Art 33(4)).

    The official text · Art 33(1)
    Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
    Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Art 33(1)

  3. Record the breach

    For every breach, reported or not

    To: Your own breach log

    Write down every personal data breach, even ones you do not report. Note the facts, the effects and what you did about it. The DPC can ask to see it.

    The official text · Art 33(5)
    The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.
    Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Art 33(5)

  4. Tell the people affected, if the risk is high

    Without undue delay

    To: The people whose data was involved

    When the breach is likely to result in a high risk to them, tell them without undue delay, in clear and plain language. This may not be needed if the data was protected so that nobody unauthorised can read it, such as by encryption (Art 34(3)(a)).

    The official text · Art 34(1) and 34(3)(a)
    When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
    in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption
    Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Art 34(1) and 34(3)(a)

Read the text: NIS2 Article 23, GDPR Article 33 and Article 34. Rules read on 18 October 2026. Hours are counted from the moment you became aware, which is the cautious reading.

Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts. Other duties may apply too, for example to your insurer, your customers under contract, or sector rules.