Data Breach Response Checklist Ireland (Free, On-Device)

0 of 17 steps checked

Phase 1 — Immediately: contain and preserve

Appoint a single incident ownerOne named person coordinates. The 72-hour clock does not pause for internal diary alignment.

Stop the breach continuingDisable compromised accounts, isolate affected systems, attempt recall of misdirected messages, change exposed credentials.

Preserve evidence and start a timelineSecure logs, the offending email or export, access records. Note when the organisation became aware — that timestamp starts the legal clock.

Check whether a processor is involvedIf a vendor caused or detected the incident, invoke the cooperation terms of your processor agreement and get their facts in writing.

Phase 2 — Within hours: assess the risk

Identify what data is affectedCategories matter: contact details versus financial, health or other special category data changes the risk profile entirely.

Identify whose data and how many peopleNumbers and categories of individuals — employees, customers, children — feed both the risk assessment and any notification.

Assess the realistic exposureSent to one known recipient who confirmed deletion is a different universe from exfiltration by an unknown attacker.

Assess likely consequences for individualsFraud, identity theft, distress, reputational or physical risk. This judgment drives every notification duty that follows.

Document the assessment — including a decision not to notifyIf you conclude the breach is unlikely to result in a risk, that reasoning must be recorded. It is the decision you may later have to defend.

Phase 3 — Within 72 hours: notify where required

Notify the DPC unless risk is unlikelyWithout undue delay and where feasible within 72 hours of awareness: nature of the breach, categories and approximate numbers, likely consequences, measures taken. Phased notification is permitted as facts emerge.

If past 72 hours, notify anyway with reasonsA late, candid notification with good containment is defensible. Discovered non-notification is not.

Tell affected individuals if risk is highWithout undue delay, in plain language: what happened, what data, what you are doing, what they should do (passwords, vigilance for phishing, fraud alerts). Exceptions apply where encryption neutralises the risk.

Notify insurers and take advice as neededCyber policies carry their own notification deadlines, and legal advice early shapes both the regulatory engagement and any claims exposure.

Phase 4 — Afterwards: record and fix

Complete the internal breach register entryFacts, effects, remedial action — required for every breach whether or not notified, and the first thing the DPC asks for.

Fix the root causeTechnical controls, and retraining where the cause was human — misdirected email remains the perennial.

Review the processor contract if a vendor was involvedCooperation, notification timing and liability terms earn their keep exactly here.

Prepare for follow-on requestsAccess requests and claims from affected individuals follow breaches. The file built in the first 72 hours is what answers them.

This checklist is general guidance, not legal advice, and does not replace advice on a live incident. The full explanation of each duty is in our breach response guide. For advice on a live breach, contact us.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.