In the first 48 hours of a crisis, let protocol speak.

Why are the first hours decisive?

In crises, the most lasting damage arises from wrong decisions made in the first hours: a deleted record, a hastily issued statement, a missed notification deadline. The first 48 hours are the window in which evidence, liability, and communication must all be managed at once. This is the service counterpart of the roadmap we detail in our crisis guide.

In a data breach, the 72-hour regime and our cyber response line; in a search and seizure, record-keeping discipline and on-site response; in a product crisis, recalls and supply contracts; in a media crisis, access blocking and rebuttal tools come to the fore. The crisis desk must be able to recognise the scenario and reorder the priority list within minutes.

The first call sets the clock

The engagement follows a fixed rhythm. Intake call: within the first hour, the incident map is sketched and the privileged workstream is set up so that analysis stays protected. Execution: the 48-hour checklist runs — evidence preservation instructions, the notification inventory in deadline order (the 72-hour data-breach regime under the KVKK and GDPR Article 33 among the tightest), and the approval chain for every outgoing statement. Handoff: by day three, the file passes to the specialist tracks — communication coordination, authority liaison, defence or recovery — under one coordinating strategy. Post-incident: a lessons memo updates the protocol.

The time pressure comes from scattered sources that have to end up on one list: on the KVKK (No. 6698) side, the 72-hour breach notification that follows from the Board’s settled practice; the same window in Article 33 GDPR; where you serve customers caught by NIS2, the 24-hour early warning, 72-hour notification and one-month final report ladder that reaches you through your contracts; the notice conditions in the insurance policies, counted in days; and, in a search-and-seizure scenario, the procedural rights that have to be exercised on the spot or not at all. The picture differs from company to company, so when the crisis protocol is built we draw up that company’s own inventory of deadlines and put a named owner against every item on it. For the sector framework, our NIS2 record is the place to start.

The first-48-hours structure is used most by manufacturing and logistics operations dealing with a product safety incident, by e-commerce and SaaS companies facing a data breach, by regulated businesses put through an unannounced inspection, and by companies on a retainer that already have the protocol in place. What the set-up project delivers is concrete: scenario cards written for the company, the deadline and notification matrix, the incident log template, the notification files and the post-incident report, and one tabletop exercise a year. Where there is a German parent the protocol is built in both languages, and the balance between what group headquarters expects to be told and the defence strategy in Türkiye — the language of the correspondence above all — is settled at the outset. The rules for dealing with the authorities themselves are covered by our authority and audit liaison service.