On the night of a breach, let protocol, not panic take over.

The anatomy of the first 72 hours

A data breach or cyber incident starts four clocks at once: the KVKK and GDPR notification deadlines, the 24-72 hour commitments in customer contracts (increasingly driven by NIS2), the notice conditions of the cyber-insurance policy, and the clock on evidence degradation. Managing these four clocks under a single command structure often determines the damage of the incident more than the incident itself.

Making decisions in the moment of an incident is the most expensive method. A pre-prepared response plan answers, before the incident, the questions of who will be called, which logs will be frozen, where the notification drafts are, and who the spokesperson is. An annual tabletop exercise keeps the plan from remaining on paper. For the board-of-directors dimension, see our NIS2 analysis.

Two of the four clocks come straight from statute. Under Article 12 KVKK the Board must be notified “at the earliest opportunity” — its settled practice takes 72 hours as the benchmark — and the affected individuals must be told by the quickest route available. Articles 33–34 GDPR set the 72-hour notification and, where the risk is high, direct communication to the individuals themselves. In the sectors caught by NIS2 the staged regime — early warning within 24 hours, notification within 72, a final report within a month — is now being pushed down to suppliers through contract. The notification threshold is a legal judgment: not every incident is notifiable, and notifying late is a ground for a penalty in its own right. Making that judgment inside a few minutes is only possible against a classification matrix worked out in advance.