{"id":3568,"date":"2026-10-09T08:18:31","date_gmt":"2026-10-09T08:18:31","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3568"},"modified":"2026-10-09T08:18:51","modified_gmt":"2026-10-09T08:18:51","slug":"first-72-hours-company-incident-poland","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/first-72-hours-company-incident-poland\/","title":{"rendered":"The First 72 Hours After an Incident at a Company in Poland"},"content":{"rendered":"

Monday morning. Three messages in the CEO\u2019s inbox: HR reports a conflict in the development team, the DPO flags a possible leak of customer data, and a report has been submitted through the anonymous whistleblowing channel. All three concern the same person. The CEO does not know where to start \u2014 whether the deadline is 72 hours, 7 days, or whether action should be taken \u201cwithout delay". And it is precisely this moment \u2014 between the event and the first decision \u2014 that determines whether the company emerges from the incident in a controlled manner or pays more for the chaos than for the problem itself.<\/p>\n

If you run a technology company, SaaS business or scale-up, this scenario is not abstract. In 2024, CERT Polska recorded more than 100,000 confirmed security incidents<\/strong> \u2014 a 29% increase year on year. KPMG research indicates that 83% of companies<\/strong> recorded attempted attacks. And yet only 18% of small businesses<\/strong> have an incident response plan.<\/p>\n

This article is a guide to the first 72 hours after an incident at a company. It is not a legal analysis, but an operational manual: how to classify the event, whom to notify, what to preserve, what not to do \u2014 and how to document the response in a way that protects the management board.<\/p>\n

Key terms to understand before taking action<\/h2>\n

Before we move on to the steps, it is worth clarifying the terminology. Companies often confuse three different situations, which leads them to initiate the wrong procedure or \u2014 worse still \u2014 take no action at all.<\/p>\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\nExample<\/th>\nDoes it require a formal response?<\/th>\n<\/tr>\n<\/thead>\n
Vulnerability<\/strong><\/td>\nA weakness in a system, network or software that may be exploited<\/td>\nAn outdated version of a library in an application<\/td>\nDoes not require notification, but does require remediation<\/td>\n<\/tr>\n
Potential event<\/strong><\/td>\nAn attempt to exploit a vulnerability that did not compromise the confidentiality, integrity or availability of data<\/td>\nA blocked phishing attempt<\/td>\nWorth documenting; as a rule, formal notification is not required<\/td>\n<\/tr>\n
Incident<\/strong><\/td>\nAn event that has actually caused adverse consequences \u2014 a data leak, loss of availability or harm to individuals<\/td>\nSending a customer database to an unauthorised recipient<\/td>\nYes \u2014 it triggers notification and documentation obligations<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This distinction has a direct bearing on your obligations. If the event constitutes an incident within the meaning of the GDPR, you have 72 hours<\/strong> to notify the President of the UODO<\/a>. If it is a whistleblower report \u2014 7 days<\/strong> to acknowledge receipt and 3 months<\/strong> to provide feedback. If it is an occupational health and safety violation \u2014 the response should be immediate.<\/p>\n

Misclassifying the event at the outset means that the company initiates the wrong procedure, omits mandatory actions or misses statutory deadlines. Each of these situations gives rise to separate liability.<\/p>\n

Why post-incident chaos costs more than the event itself<\/h2>\n

The greatest risk is not the data leak itself, the team conflict or the whistleblower report. The risk is a chaotic, delayed or undocumented response<\/strong>. Here is why.<\/p>\n

Concurrent liability under four legal regimes<\/h3>\n

A company incident rarely falls into a single category. A single event may trigger obligations under the GDPR, the Whistleblower Protection Act, the Labour Code and the Commercial Companies Code \u2014 all at the same time. And each of these regimes provides for separate penalties.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Legal regime<\/th>\nTypical failure<\/th>\nPenalty<\/th>\nLegal basis<\/th>\n<\/tr>\n<\/thead>\n
GDPR<\/td>\nFailure to notify the UODO of a breach within 72 hours<\/td>\nUp to EUR 10 million or 2% of turnover<\/td>\nArticles 33\u201334 and Article 83(4) GDPR<\/td>\n<\/tr>\n
GDPR<\/td>\nFailure to notify individuals where there is a high risk<\/td>\nUp to EUR 10 million or 2% of turnover<\/td>\nArticle 34 and Article 83(4) GDPR<\/td>\n<\/tr>\n
Whistleblower Protection Act<\/td>\nObstructing a report<\/td>\nUp to one year\u2019s imprisonment (up to 3 years where threats or violence are used)<\/td>\nArticle 58 of the Whistleblower Protection Act<\/td>\n<\/tr>\n
Whistleblower Protection Act<\/td>\nRetaliation against a whistleblower<\/td>\nUp to 2 years\u2019 imprisonment (up to 3 years if persistent)<\/td>\nArticle 58 of the Whistleblower Protection Act<\/td>\n<\/tr>\n
Labour Code<\/td>\nViolations of employee rights (occupational health and safety, pay)<\/td>\nFine of PLN 1,000\u201330,000<\/td>\nArticles 281\u2013283 of the Labour Code<\/td>\n<\/tr>\n
Criminal Code<\/td>\nMalicious or persistent violation of employee rights<\/td>\nUp to 2 years\u2019 imprisonment<\/td>\nArticle 218 \u00a7 1a of the Criminal Code<\/td>\n<\/tr>\n
Commercial Companies Code<\/td>\nDamage to the company caused by the management board\u2019s fault (through action or omission)<\/td>\nLiability for damages<\/td>\nArticle 293 \u00a7 1 of the Commercial Companies Code<\/td>\n<\/tr>\n
Criminal Code<\/td>\nBreach of trust \u2014 failure to fulfil duties resulting in substantial damage<\/td>\nCriminal liability<\/td>\nArticle 296 of the Criminal Code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Note that the penalty for the mere failure to notify<\/strong> a GDPR breach within 72 hours concerns a separate infringement carrying a separate penalty \u2014 regardless of how serious the leak itself was. The President of the UODO imposed a fine of PLN 103,752<\/strong> on Link4 specifically for failing to notify the breach on time, not for the incident itself. A court enforcement officer paid a total of approximately PLN 21,000<\/strong> \u2014 PLN 7,700 for failing to notify the breach and PLN 13,200 for failing to inform the person whose data was affected.<\/p>\n

Costs extend far beyond administrative fines<\/h3>\n

UODO penalties or fines imposed by the National Labour Inspectorate are only the tip of the iceberg. The full cost of a chaotic response includes:<\/p>\n

    \n
  1. Data recovery and infrastructure replacement costs<\/strong> \u2014 if the incident affected production systems<\/li>\n
  2. Personnel costs<\/strong> \u2014 overtime for IT, HR and legal teams; sometimes additional staff must be hired<\/li>\n
  3. Compensation for customers and contractors<\/strong> \u2014 particularly where NDAs or data processing agreements have been breached<\/li>\n
  4. Lost revenue<\/strong> \u2014 downtime, customer churn and suspended projects<\/li>\n
  5. Crisis advisory costs<\/strong> \u2014 lawyers, IT forensics specialists and crisis PR advisers engaged \u201cafter the fact" cost many times more than prevention<\/li>\n
  6. Employee claims<\/strong> \u2014 leave, overtime and compensation for workplace bullying if the company failed to respond to a report<\/li>\n
  7. Reputational costs<\/strong> \u2014 loss of trust among the team, customers and investors<\/li>\n<\/ol>\n

    An early, structured response is many times less expensive than repairing the damage caused by improvisation.<\/p>\n

    Contact us<\/a><\/p>\n

    The first 72 hours after an incident \u2014 what to do step by step<\/h2>\n

    Below is the sequence of actions your company should initiate as soon as an incident is identified. The order matters.<\/p>\n

    Step 1: preserve evidence \u2014 before anything else<\/h3>\n

    Before you begin analysing, classifying and making decisions \u2014 preserve the evidence. This includes:<\/p>\n

      \n
    1. Correspondence<\/strong> \u2014 emails and messages on Slack, Teams and other messaging platforms<\/li>\n
    2. System logs<\/strong> \u2014 access records, logins, changes to permissions and file transfers<\/li>\n
    3. Documents<\/strong> \u2014 agreements, notes, screenshots and reports<\/li>\n
    4. Recordings<\/strong> \u2014 if the company uses video surveillance or records calls<\/li>\n
    5. Data from HR systems<\/strong> \u2014 working time records, requests and appraisals<\/li>\n<\/ol>\n

      The rule is: do not delete, modify or move anything<\/strong>. Even if you believe a particular file is unrelated to the case. Delaying the preservation of evidence weakens the company\u2019s position under every legal regime \u2014 from the GDPR to employment disputes.<\/p>\n

      Step 2: classify the event \u2014 initiate the correct procedure<\/h3>\n

      This is the most common mistake: the company responds to an incident as though it were solely an HR problem, solely a data leak or solely an IT failure. In reality, a single event may require concurrent action across several areas.<\/p>\n

      Use the matrix below for rapid classification:<\/p>\n\n\n\n\n\n\n\n\n\n
      Question<\/th>\nIf YES \u2192 area<\/th>\nStatutory deadline<\/th>\n<\/tr>\n<\/thead>\n
      Have personal data been lost, disclosed or accessed without authorisation?<\/td>\nGDPR \u2014 notification to the UODO<\/td>\n72 hours<\/td>\n<\/tr>\n
      Was the report submitted through a whistleblowing channel, or does it concern a breach of law?<\/td>\nWhistleblower Protection Act \u2014 internal investigation<\/td>\n7 days (acknowledgement), 3 months (feedback)<\/td>\n<\/tr>\n
      Does the event concern an employment relationship \u2014 workplace bullying, discrimination or an occupational health and safety violation?<\/td>\nLabour Code \u2014 employer response<\/td>\nWithout delay<\/td>\n<\/tr>\n
      Does the event threaten the continuity of IT systems?<\/td>\nCybersecurity \u2014 incident response procedure<\/td>\n24 hours (serious incident, National Cybersecurity System Act<\/a>)<\/td>\n<\/tr>\n
      Could the event give rise to management board liability towards the company?<\/td>\nCommercial Companies Code \u2014 decision documentation<\/td>\nNo statutory deadline, but delay weakens the company\u2019s position<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      If the answer is \u201cYES" in more than one row, you are dealing with a multidisciplinary incident. You need coordination, not separate, unconnected courses of action.<\/p>\n

      Step 3: appoint an \u201cincident owner"<\/h3>\n

      Fragmented responsibility is the second most common mistake. HR thinks it is an IT matter. IT thinks it is a matter for the lawyer. The lawyer waits for information from HR. No one makes a decision.<\/p>\n

      Appoint one person (or a two-person team) who:<\/p>\n

        \n
      1. Coordinates all post-incident activities \u2014 regardless of the type of incident<\/li>\n
      2. Collects information from HR, IT, compliance and legal<\/li>\n
      3. Reports directly to the management board<\/li>\n
      4. Monitors statutory deadlines<\/li>\n
      5. Decides on the order and priority of actions<\/li>\n<\/ol>\n

        The \u201cincident owner" does not need to be an expert in every area. They need to know whom to involve and in what order.<\/p>\n

        Step 4: do no harm during the first 24 hours<\/h3>\n

        Until the incident has been fully classified, the rule is \u201cdo not make the situation worse". Here is what not to do<\/strong>:<\/p>\n

          \n
        1. Do not dismiss anyone<\/strong> \u2014 hastily terminating the contract of a person involved in a whistleblower report may be regarded as retaliation (punishable by up to 2 years\u2019 imprisonment)<\/li>\n
        2. Do not communicate publicly<\/strong> \u2014 either internally or externally, until you know the facts and have agreed on the narrative<\/li>\n
        3. Do not delete correspondence or logs<\/strong> \u2014 even if they appear incriminating<\/li>\n
        4. Do not make statements<\/strong> \u2014 written or oral \u2014 that may later be used against the company<\/li>\n
        5. Do not ignore deadlines<\/strong> \u2014 the 72-hour deadline for notifying a GDPR breach runs from the moment the breach is identified<\/strong>, not from the moment it has been \u201cfully investigated"<\/li>\n<\/ol>\n

          Recital 87 of the GDPR expressly states that the assessment of whether notification was made \u201cwithout undue delay" should take into account the nature and gravity of the breach and its consequences. A documented decision-making process may protect the company even in the event of a minor delay. A lack of documentation will not.<\/p>\n

          Step 5: document every decision in real time<\/h3>\n

          Every decision made during an incident should be recorded together with:<\/p>\n

            \n
          1. The date and time<\/strong> it was made<\/li>\n
          2. The decision-maker<\/strong> \u2014 who made the decision<\/li>\n
          3. The rationale<\/strong> \u2014 why the decision was made and what information it was based on<\/li>\n
          4. The alternatives<\/strong> \u2014 what other options were considered<\/li>\n<\/ol>\n

            The format does not need to be formal. An email to yourself, a note in a document or an entry in an incident management tool \u2014 they all count, provided they include a date and content.<\/p>\n

            Why is this so important? For two reasons.<\/p>\n

            First, Article 33(5) GDPR<\/strong> requires the documentation of all<\/strong> personal data breaches<\/a> \u2014 including those that the company has decided not to notify to the UODO. You must have a written justification for that decision.<\/p>\n

            Second, Article 293 \u00a7 3 of the Commercial Companies Code<\/strong> (the business judgement rule) may protect the management board against liability for damages \u2014 but only if the board demonstrates that it acted loyally towards the company, within the limits of reasonable risk and on the basis of adequate information and analysis<\/strong>. Without documentation, there is nothing to demonstrate.<\/p>\n

            When an incident does not fit into a single category \u2014 conflicting procedures<\/h2>\n

            At technology companies, incidents rarely concern just one area. A typical scenario is that the CTO leaves the company and takes the code repository. This simultaneously constitutes:<\/p>\n

              \n
            1. An IP issue<\/strong> \u2014 infringement of rights to the source code<\/li>\n
            2. A GDPR breach<\/strong> \u2014 if the code or systems contained customers\u2019 personal data<\/li>\n
            3. An NDA breach<\/strong> \u2014 if the code contained solutions covered by confidentiality agreements with contractors<\/li>\n
            4. An HR issue<\/strong> \u2014 if the person was employed under an employment contract and is subject to a non-compete obligation or confidentiality clause<\/li>\n
            5. A cybersecurity incident<\/strong> \u2014 if production systems were accessed without authorisation<\/li>\n<\/ol>\n

              Each of these areas has a different response deadline, supervisory authority and procedure. Without coordination, the company risks taking contradictory actions: the legal department sends a formal demand, HR conducts an investigatory interview, IT blocks access \u2014 while no one has checked whether the breach must be notified to the UODO within 72 hours.<\/p>\n

              A particular conflict: a whistleblower report and a GDPR breach<\/h3>\n

              The Whistleblower Protection Act<\/a> and the GDPR have different deadlines and procedures, but may apply to the same event. If a whistleblower reports a personal data leak, the company must simultaneously:<\/p>\n

                \n
              1. Acknowledge receipt of the whistleblower report within 7 days<\/strong><\/li>\n
              2. Notify the UODO of the personal data breach within 72 hours<\/strong><\/li>\n
              3. Conduct an internal investigation under the whistleblowing procedure and provide feedback to the whistleblower<\/a> within 3 months<\/strong><\/li>\n
              4. Protect the whistleblower\u2019s identity (Article 8 of the Whistleblower Protection Act excludes the obligation to inform the person concerned by the report about the source of the data \u2014 Article 14(2)(f) GDPR)<\/li>\n<\/ol>\n

                These procedures must run concurrently, but they must not obstruct one another. The person conducting the internal investigation under the whistleblowing procedure should not also decide whether to notify the UODO \u2014 these should be independent tracks with a single coordination point.<\/p>\n

                How to protect the management board \u2014 the business judgement rule following the amendment to the Commercial Companies Code<\/h2>\n

                The amendment to the Commercial Companies Code of 9 February 2022 (which entered into force on 13 October 2022) introduced the business judgement rule<\/a> into Article 293 \u00a7 3. In simple terms, a management board member is not liable for damage caused to the company if they acted loyally and within the limits of reasonable business risk \u2014 including on the basis of information, analyses and opinions that should have been taken into account in the circumstances.<\/p>\n

                For incident response, this means specific requirements:<\/p>\n\n\n\n\n\n\n\n
                Condition for protection<\/th>\nWhat this means during an incident<\/th>\nHow to document it<\/th>\n<\/tr>\n<\/thead>\n
                Loyalty towards the company<\/td>\nThe management board acted in the company\u2019s interests, not in its own interests or those of third parties<\/td>\nA decision note indicating that the actions were intended to protect the company<\/td>\n<\/tr>\n
                Reasonable business risk<\/td>\nThe decision was proportionate to the situation \u2014 neither overly cautious nor excessively risky<\/td>\nA description of the alternatives considered and the reasons for selecting the chosen option<\/td>\n<\/tr>\n
                Adequate information and analysis<\/td>\nThe management board collected the available data before making its decision \u2014 it did not act \u201cblindly"<\/td>\nIncident classification report, legal opinion and risk analysis<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                Limit of protection:<\/strong> the business judgement rule does not protect against liability for breaching mandatory legal provisions. If the management board knew about a GDPR breach and deliberately failed to notify it within 72 hours, the business judgement rule will not help.<\/p>\n

                Prepare your company before an incident occurs \u2014 readiness checklist<\/h2>\n

                Companies often have policies, regulations and procedures on paper but do not know how to apply them in a crisis. Below are the measures worth implementing before<\/strong> an incident occurs.<\/p>\n

                Priority measures (implement immediately)<\/h3>\n
                  \n
                1. \n

                  Check whether you have a written incident response procedure.<\/strong> Not a general security policy, but a specific sequence: who responds, in what order, what deadlines apply and who makes the decisions. If a procedure exists but no one knows it \u2014 it may as well not exist.<\/p>\n<\/li>\n

                2. \n

                  Prepare an initial response card<\/strong> \u2014 a one-page document containing a checklist of the first 10 actions following an incident: whom to notify, what to preserve, what not to do and what deadlines are running. Distribute it to the management board, HR, IT and the person responsible for compliance.<\/p>\n<\/li>\n

                3. \n

                  Establish an incident classification matrix<\/strong> \u2014 a table (like the one above in this article) that allows you to quickly determine whether an event is an HR issue, a GDPR breach, a whistleblower report, a cyber incident or a management risk.<\/p>\n<\/li>\n

                4. \n

                  Appoint an incident owner<\/strong> \u2014 one person to coordinate the response, regardless of the type of incident.<\/p>\n<\/li>\n

                5. \n

                  Introduce the practice of documenting decisions in real time<\/strong> \u2014 even in the form of an email containing the date, the decision and its rationale.<\/p>\n<\/li>\n<\/ol>\n

                  Recommended measures (implement within one month)<\/h3>\n
                    \n
                  1. \n

                    Train the management board and managers<\/strong> in the principle of \u201cdoing no harm during the first 24 hours" \u2014 what not to communicate, what not to delete and whom not to dismiss before the event has been fully classified.<\/p>\n<\/li>\n

                  2. \n

                    Compile a crisis contact list<\/strong> \u2014 external lawyer, GDPR specialist, IT forensics company and crisis PR adviser. Keep it somewhere accessible before it is needed. Looking for support during a crisis costs hours you do not have.<\/p>\n<\/li>\n

                  3. \n

                    Ask a lawyer to review the existing procedures<\/strong> (workplace regulations, GDPR policy, whistleblowing procedure and IT security policy) for consistency \u2014 to check whether they contain conflicting provisions on who should respond and within what timeframe.<\/p>\n<\/li>\n

                  4. \n

                    Review the incident response clauses in your agreements with IT providers<\/a>.<\/strong> If there are none, it is unclear who \u2014 the company or the provider \u2014 is responsible for which actions when an incident occurs. Properly drafted clauses allocate tasks to the parties, specify deadlines and divide responsibility.<\/p>\n<\/li>\n<\/ol>\n

                    Additional measures (implement within one quarter)<\/h3>\n
                      \n
                    1. \n

                      Conduct a tabletop exercise<\/strong> \u2014 simulate an incident scenario (e.g. a customer data leak and a whistleblower report occurring at the same time) and check whether the team knows what to do. You will identify procedural gaps before a real problem arises.<\/p>\n<\/li>\n

                    2. \n

                      After every incident \u2014 even a minor one \u2014 hold a 30-minute \u201clessons learned" meeting<\/strong> with the team. What worked, what did not and what should be changed in the procedure. Update the initial response card.<\/p>\n<\/li>\n<\/ol>\n

                      We can help you<\/h2>\n

                      Incident response requires coordination across many areas of law \u2014 the GDPR, employment law, the Whistleblower Protection Act, corporate law and cybersecurity. A single lawyer specialising in one area will not be enough if an event extends beyond one category.<\/p>\n

                      We support technology companies and scale-ups under three models:<\/p>\n

                        \n
                      1. \n

                        Incident readiness audit<\/strong> \u2014 we check whether your company has procedures, whether they are consistent, whether the team knows them and whether statutory deadlines have been taken into account. You receive a report identifying specific gaps and recommendations.<\/p>\n<\/li>\n

                      2. \n

                        Support during an incident<\/strong> \u2014 we coordinate the legal response, help classify the event, monitor notification deadlines and prepare documentation that protects the management board. We act as an external coordination point so that you can focus on running the company.<\/p>\n<\/li>\n

                      3. \n

                        Procedure implementation and training<\/strong> \u2014 we prepare an initial response card, classification matrix and breach management procedure, and train the management board and managers in incident response principles.<\/p>\n<\/li>\n<\/ol>\n

                        We bring together employment law, the GDPR, IT law and corporate law within a single team \u2014 because incidents at technology companies rarely fit neatly into one category.<\/p>\n

                        A structured response protects the company better than the absence of an incident<\/h2>\n

                        No procedure will prevent every incident. But a structured response \u2014 rapid classification, preservation of evidence, documentation of decisions and coordination of actions \u2014 can limit financial losses, protect the management board from personal liability and allow the company to resume normal operations sooner.<\/p>\n

                        Three things to do after reading this article:<\/p>\n

                          \n
                        1. Check whether your company has a written incident response procedure \u2014 and whether anyone knows it.<\/li>\n
                        2. Appoint a person responsible for coordinating incident response.<\/li>\n
                        3. Prepare an initial response card and a crisis contact list.<\/li>\n<\/ol>\n

                          If you need support with an incident readiness audit, preparing procedures or training the management board \u2014 contact us<\/a>.<\/p>\n

                          Frequently asked questions<\/h2>\n

                          We have an incident, but we do not know whether it is \u201cserious" \u2014 how can we quickly assess whether a formal response is required?<\/strong><\/p>\n

                          Use three screening questions: (1) Have personal data been lost, disclosed or accessed without authorisation? If so, you have 72 hours to assess the incident and potentially notify the UODO. (2) Was the report submitted through a whistleblowing channel? If so, you have 7 days to acknowledge receipt. (3) Does the event concern employee safety? If so, the response should be immediate. If the answer is \u201cyes" to more than one question, you are dealing with a multidisciplinary incident and need coordination.<\/p>\n

                          Who in the company should make decisions following an incident \u2014 the management board, HR, a lawyer or the compliance officer?<\/strong><\/p>\n

                          Strategic decisions (notification to a supervisory authority, external communications and staffing decisions) belong to the management board. Operational coordination should be handled by an appointed \u201cincident owner" \u2014 a person who gathers information from HR, IT, compliance and legal, monitors deadlines and reports to the management board. They do not need to be an expert in every area, but they must know whom to involve and in what order.<\/p>\n

                          Is the management board personally liable if the company responded to an incident too slowly or incorrectly?<\/strong><\/p>\n

                          Yes \u2014 under Article 293 \u00a7 1 of the Commercial Companies Code, a management board member is liable for damage caused to the company by an action or omission contrary to the law. The 2022 amendment to the Commercial Companies Code introduced the business judgement rule (Article 293 \u00a7 3), which may protect the management board \u2014 but subject to three conditions: loyalty towards the company, acting within the limits of reasonable risk and basing decisions on adequate information. Without a documented decision-making process, there is nothing to demonstrate. Moreover, this rule does not protect against liability for breaching mandatory legal provisions \u2014 for example, knowingly missing the 72-hour deadline for notifying a GDPR breach.<\/p>\n

                          We have procedures on paper, but no one knows them \u2014 does this protect us or count against us during an inspection?<\/strong><\/p>\n

                          It counts against you. A procedure that the team does not know or follow does not satisfy the accountability requirement (Article 5(2) GDPR) or the obligation to implement appropriate organisational measures. During an inspection by the UODO or the National Labour Inspectorate, or in court proceedings, the company must demonstrate that the procedures were implemented, known and followed \u2014 not merely written down. This is why regular training and tabletop exercises are just as important as the document itself.<\/p>\n

                          Everything has settled down after the incident \u2014 do I still need to do anything to close the matter formally?<\/strong><\/p>\n

                          Yes. Closing the matter requires: (1) an entry in the breach register (the GDPR requires all breaches to be documented, including those not notified to the UODO, together with the reasons for the decision not to notify), (2) feedback to the whistleblower within 3 months (if the event concerned a whistleblower report), (3) a closing note describing the actions taken, conclusions and recommendations, and (4) updates to procedures based on lessons learned from the incident. The aim is to prepare the company for questions from a regulator, employee, contractor, auditor or court \u2014 even if they arise several months later.<\/p>\n

                          How should an incident be communicated internally without causing panic or concealing the problem?<\/strong><\/p>\n

                          Communicate facts, not speculation. Appoint one person responsible for internal communications. Provide the team with three pieces of information: (1) what happened (without details that could prejudice the investigation), (2) what the company is doing in response, and (3) whom to contact with questions. Avoid messages such as \u201cnothing happened" \u2014 if the incident later proves serious, the company will lose credibility. Also avoid excessive alarmism \u2014 it makes it more difficult to conduct a calm internal investigation.<\/p>\n","protected":false},"excerpt":{"rendered":"

                          Learn how to preserve evidence, classify overlapping incidents, track Polish notification deadlines and document management board decisions in the first 72 hours.<\/p>\n","protected":false},"author":13,"featured_media":3605,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"9f9ad173-8839-47ad-ae20-ffe25f1b0c47","sip_pair_state":"verified"},"categories":[],"tags":[1555,1533,1446,1546,1534,1532],"specialization":[1215],"practice_area":[],"class_list":["post-3568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-corporate-governance-en","tag-data-breach","tag-gdpr","tag-risk-assessment","tag-uodo-en","tag-whistleblowers","specialization-gdpr"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3568"}],"version-history":[{"count":2,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3568\/revisions"}],"predecessor-version":[{"id":3571,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3568\/revisions\/3571"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3605"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3568"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3568"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}