What if I have a data breach?

GDPR requires that you notify the appropriate regulators within 72 hours. At that time, you must be able to identify what data and data subjects were compromised, the consequences/severity of the data, and the actions that your firm needs to take or is taking.