Contact

Data breach? We will tell you what it means and what to do.

We will check whether this is a personal data breach. We will tell you whether the matter must be reported to the UODO and whether the individuals concerned must be notified. You will receive a clear list of steps from us. In urgent matters, we return with an initial assessment within a few hours.

Find out what to do in your situation

After an incident, three questions arise: what is it, what must we do, and who decides. Without that, chaos comes easily, and time is usually short.

First we organise the facts. Then we take a decision that can be clearly justified – inside the company and externally.

IT gathers the facts, the business wants to limit the impact, and the legal and data-protection teams must close out their duties. The management board needs one answer: what we are doing and why. We step in immediately and organise the matter step by step.

Mateusz Sawaryn

Managing Partner Counsel

CHALLENGES

the most common problems we solve

Is this even a breach? Not every incident is a data breach. But a wrong classification costs you: either you trigger procedures unnecessarily, or you are late with what must be done.

We will check whether the event triggers GDPR duties and tell you what to do straight away. You receive a list of actions for the first hours and information on what is still missing for the next decisions.

Business benefit: a fast start on the right actions and fewer internal disputes.

Risk of inaction: delays and decisions taken without a proper basis.

You have little information, but decisions are already needed At the start it is rarely clear exactly what happened and whom it affects. Even so, you must watch deadlines and avoid making the problem worse.

We will set priorities for the first hours and help you decide with incomplete information. We will also clarify who does what so actions do not diverge across departments.

Business benefit: control over actions and fewer unnecessary moves.

Risk of inaction: dragging out decisions and a higher risk of formal errors.

It is unclear who is responsible for what IT, legal, data protection, the business, the management board and external providers each see the incident from a different angle. Without one action path, conflicting decisions and communication chaos appear quickly.

We define roles, responsibilities and the sequence of actions. We indicate who decides, what duties arise from contracts with counterparties, and how to protect the company's position.

Business benefit: fewer misunderstandings between departments and faster decisions by the management board.

Risk of inaction: blurred accountability, internal conflicts and errors in communication with partners.

Report to the UODO or not? This is one of the hardest decisions after an incident. The company must not only choose a direction, but also be able to justify and document it.

We assess the reporting duty, prepare the rationale for the position taken, and support preparation of the report if it is needed.

Business benefit: greater certainty of the decision and coherent documentation if questions or further verification arise.

Risk of inaction: a late response, an incomplete report, or no rationale for the position taken.

Whether and how to notify individuals You do not always have to notify individuals. If you do - the message must be clear and complete, because mistakes return as questions, complaints and extra work.

We will say whether notification is required. If it is - we will prepare the message: plain, factual and without unnecessary risks.

Business benefit: greater control over the message and fewer misunderstandings.

Risk of inaction: inconsistent information, extra questions and communication chaos.

How to close the matter and not face the same problem in a month? After the first response, many companies simply want to "close the topic". Without a summary and a remediation plan, the incident leaves open risks.

We prepare a summary of the event, decisions and remediation recommendations. You receive material for the management board and a change plan that genuinely reduces the risk of recurrence.

Business benefit: concrete conclusions, clear responsibilities and greater readiness for the future.

Risk of inaction: repeating the same mistakes and "closing" the matter only on paper.

Our solution

from the first classification to the remediation plan

We do not leave you with interpretation alone. We walk through the decisions and documents so you know what to do at each moment – and have it properly described.

Fast classification of the event

  • We gather the key facts.
  • We separate what we know from what still needs to be established.
  • We make a preliminary assessment of whether this is a personal data breach.
  • We set priorities for the first hours.

 

  • Preliminary classification of the event and a list of urgent decisions.

Analysis of the scale and effects of the incident

  • We describe what happened and how it came about.
  • We estimate the scale and possible effects for individuals.
  • We identify risks and propose scenarios for further action.

 

  • Risk assessment and scenarios for further action.

Assessment of duties toward the authority

  • Analysis of the duty to notify the President of the UODO.
  • Preparation of the rationale for the position taken.
  • Indication of a safe and practical course of action.
  • Support for decisions under time pressure.

 

  • Recommendation: we report / we do not report, with rationale.

Preparing the notification and documentation

  • Drafting the breach notification.
  • circumstances, effects and measures taken.
  • Organising the material for the management board and the operational team.
  • Securing consistency of the position and documentation.

 

  • Ready incident documentation and a full set of materials for further action.

Support for communication to individuals and partners

  • Assessment of whether the individuals concerned must be notified.
  • Setting the direction and content of communication.
  • Analysis of duties toward counterparties, processors and partners.
  • Support in organising communication among stakeholders.

 

  • A communication plan and recommendations for relations with individuals and partners.

Closing the matter and a remediation plan

  • Summary of the event and decisions taken.
  • Remediation recommendations.
  • Indication of process and organisational changes.
  • An action plan reducing the risk of the incident recurring.

 

  • A summary for the management board or team and a post-incident remediation plan.

Who this service is for

for organisations that, after an incident, must move quickly to the right decisions

For situations where, after an incident, you must move quickly from “we do not know” to decisions and action – without chaos between departments.

Data Protection Officer / person responsible for data protection

When you need to establish quickly whether a breach occurred and which duties to trigger.

Example: “Suspected data leak following a supplier error. Within 24 hours: assess the incident, decide whether to report it, and prepare the documentation and communication to individuals.”

Legal team / head of compliance

When you need a risk assessment, a recommendation for the management board and coherent documentation.

  • Anonymised case descriptions: briefly, what happened, what we did and what the outcome was.
  • Expert content: publications, talks or commentary on incidents and data controller obligations.
  • A list of materials provided after an engagement, such as an incident assessment, recommendation, notification or remediation plan.

Management board / chief operating officer

When a fast decision, risk limitation and organised team action matter.

Stages of work

how collaboration looks step by step

In an incident, the sequence of actions matters. That is why we work in stages: we gather facts, take decisions, prepare documents and close the matter with a remediation plan.

Initial assessment and classification

We gather the key information, establish what is known and assess whether a personal data breach occurred and which decisions are urgent.

Analysis and decisions

We assess the scale and impact of the incident. We check obligations towards the President of the Personal Data Protection Office (UODO), individuals and partners. Finally, you receive a recommendation on what we will do and why.

Documentation and communication

We prepare notifications, supporting explanations and materials needed for the next steps. We also help make the communications consistent and clear.

Remedial actions

We summarise the incident, decisions and risks. We identify organisational and process changes needed to reduce the risk of recurrence.

Find out what to do in your situation.

Find out what to do in your situation

Contact us

Do you have an incident? Write - we will tell you where to start.

In an incident, a good start matters. We will organise the facts, set priorities and help take the first decisions.

Write briefly: what happened, when it was detected and which data may be affected. If a provider is involved – add which one. That is enough to begin.

Mateusz Sawaryn

    By submitting this form, you acknowledge that the personal data you provide will be processed by Kancelaria Prawna Sawaryn i Partnerzy sp.k. to handle your enquiry and contact you about it. Details are available in our Privacy Policy. The rules governing the use of this website are set out in the Terms and Conditions.