{"id":2753,"date":"2026-10-09T08:18:24","date_gmt":"2026-10-09T08:18:24","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=2753"},"modified":"2026-10-09T08:18:42","modified_gmt":"2026-10-09T08:18:42","slug":"company-incident-first-72-hours-poland","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/company-incident-first-72-hours-poland\/","title":{"rendered":"The First 72 Hours After an Incident at a Company in Poland"},"content":{"rendered":"

The First 72 Hours After an Incident at a Company in Poland<\/h1>\n

Monday morning. The CEO has three messages: HR reports a conflict in the development team; the data protection officer flags a possible customer data leak; and a report has arrived through the anonymous whistleblowing channel. All three concern the same person.<\/p>\n

Where should the CEO start? Is there a 72-hour deadline, a seven-day deadline, or an obligation to act \u201cwithout delay\u201d? The decisions made between discovering an event and establishing what happened can determine whether the company manages the incident\u2014or incurs greater costs through a disorganized response.<\/p>\n

For a technology company, SaaS business, or scale-up operating in Poland, this is a practical concern. In 2024, CERT Polska recorded more than 100,000 confirmed security incidents<\/strong>, up 29% year over year. KPMG research indicates that 83% of companies<\/strong> recorded attempted attacks, yet only 18% of small businesses<\/strong> have an incident response plan.<\/p>\n

This is an operational guide to the first 72 hours: how to classify an event, whom to involve, what to preserve, what to avoid, and how to document decisions so the company and its management board can account for their response.<\/p>\n

First, distinguish a vulnerability from an incident<\/h2>\n

Companies sometimes treat every warning as a reportable incident\u2014or overlook an event that needs a formal response. These working distinctions help identify the next step:<\/p>\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\nExample<\/th>\nTypical response<\/th>\n<\/tr>\n<\/thead>\n
Vulnerability<\/strong><\/td>\nA weakness in a system, network, or software that could be exploited<\/td>\nAn outdated software library in an application<\/td>\nRemediate it; the vulnerability itself does not require notification<\/td>\n<\/tr>\n
Potential event<\/strong><\/td>\nAn attempted exploitation that did not compromise the confidentiality, integrity, or availability of data<\/td>\nA blocked phishing attempt<\/td>\nDocumenting it is worthwhile; formal notification is generally not required<\/td>\n<\/tr>\n
Incident<\/strong><\/td>\nAn event that has caused adverse consequences, such as a data leak, loss of availability, or harm to individuals<\/td>\nA customer database sent to an unauthorized recipient<\/td>\nAssess and initiate applicable notification and documentation procedures<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The classification affects the clock. A personal data breach may require notification to the President of the Personal Data Protection Office (UODO)<\/strong> within 72 hours<\/strong> under the GDPR; see our guide to reporting a personal data breach in Poland<\/a>. A whistleblower report brings a seven-day<\/strong> period for acknowledging receipt and a three-month<\/strong> period for feedback. An occupational health and safety issue calls for an immediate response.<\/p>\n

Misclassification can mean using the wrong procedure, omitting a required action, or missing a statutory deadline. Each can create a separate liability risk.<\/p>\n

Why a disorganized response can cost more than the event<\/h2>\n

A data leak, workplace conflict, or whistleblower report is serious in itself. A late, contradictory, or undocumented response can add legal and operational costs.<\/p>\n

One event can engage several Polish legal regimes<\/h3>\n

An incident may simultaneously involve the GDPR, Poland\u2019s Whistleblower Protection Act, the Labor Code, and the Commercial Companies Code. Criminal Code provisions may also be relevant. The following examples show the separate exposures described in the approved source:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Legal regime<\/th>\nTypical failure<\/th>\nStated consequence<\/th>\nLegal basis<\/th>\n<\/tr>\n<\/thead>\n
GDPR<\/td>\nFailure to notify UODO of a breach within 72 hours<\/td>\nUp to EUR 10 million or 2% of turnover<\/td>\nArticles 33\u201334 and 83(4) GDPR<\/td>\n<\/tr>\n
GDPR<\/td>\nFailure to notify affected individuals where there is a high risk<\/td>\nUp to EUR 10 million or 2% of turnover<\/td>\nArticles 34 and 83(4) GDPR<\/td>\n<\/tr>\n
Whistleblower Protection Act<\/td>\nObstructing a report<\/td>\nUp to one year\u2019s imprisonment; up to three years where threats or violence are used<\/td>\nArticle 58 of the Whistleblower Protection Act<\/td>\n<\/tr>\n
Whistleblower Protection Act<\/td>\nRetaliation against a whistleblower<\/td>\nUp to two years\u2019 imprisonment; up to three years if persistent<\/td>\nArticle 58 of the Whistleblower Protection Act<\/td>\n<\/tr>\n
Labor Code<\/td>\nViolating employee rights concerning, for example, occupational health and safety or pay<\/td>\nFine of PLN 1,000\u201330,000<\/td>\nArticles 281\u2013283 of the Labor Code<\/td>\n<\/tr>\n
Criminal Code<\/td>\nMalicious or persistent violation of employee rights<\/td>\nUp to two years\u2019 imprisonment<\/td>\nArticle 218 \u00a7 1a of the Criminal Code<\/td>\n<\/tr>\n
Commercial Companies Code<\/td>\nDamage to the company caused by a management board member\u2019s action or omission through fault<\/td>\nLiability for damages<\/td>\nArticle 293 \u00a7 1 of the Commercial Companies Code<\/td>\n<\/tr>\n
Criminal Code<\/td>\nBreach of trust through failure to perform duties resulting in substantial damage<\/td>\nCriminal liability<\/td>\nArticle 296 of the Criminal Code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Failure to make a required GDPR notification is a separate infringement from the underlying leak. As examples, UODO fined Link4 PLN 103,752<\/strong> for failing to notify a breach on time, rather than for the incident itself. A court enforcement officer paid approximately PLN 21,000<\/strong> in total: PLN 7,700 for failing to notify the authority and PLN 13,200 for failing to inform the affected person.<\/p>\n

Regulatory penalties are only part of the potential cost. A disorganized response can also lead to:<\/p>\n

    \n
  1. Data recovery and infrastructure replacement costs<\/strong> if production systems are affected.<\/li>\n
  2. Personnel costs<\/strong>, including overtime for IT, HR, and legal teams or the need for additional staff.<\/li>\n
  3. Customer and business-partner claims<\/strong>, particularly where confidentiality or data processing agreements are involved.<\/li>\n
  4. Lost revenue<\/strong> from downtime, customer departures, or paused projects.<\/li>\n
  5. Crisis advisory costs<\/strong> for legal, IT forensics, and communications support engaged after the event.<\/li>\n
  6. Employee claims<\/strong> concerning leave, overtime, or workplace bullying if reports were not addressed.<\/li>\n
  7. Reputational damage<\/strong> among employees, customers, and investors.<\/li>\n<\/ol>\n

    An early, coordinated response is generally less costly than trying to repair the consequences of improvisation.<\/p>\n

    The first 72 hours: an operational sequence<\/h2>\n

    Start these actions as soon as the event is identified. Several workstreams may need to run at once, but they should be coordinated.<\/p>\n

    Step 1: Preserve evidence<\/h3>\n

    Before reaching conclusions, secure material that may establish what happened:<\/p>\n