When something happens: a calm, step-by-step incident response
A hacked mailbox, a ransomware note, a lost laptop. QoBot gives you the next step, one at a time, works out who must be told and by when, and drafts each notification for you to send.
Contained at 10:40: the mailbox password is reset and the forwarding rule removed. Customer emails may have been read, so this is likely a personal data breach. Clocks run from 9:15 today:
- You: decide on notifying the data protection authority · draft ready · due Thursday 9:15Needs you
- Léa (IT provider): export the mailbox sign-in logs · request drafted · ~20 minYour turn
- Marc (sales): warn the 3 customers who received the fake invoice · email drafted · ~10 minYour turn
During an incident: who does what
What QoBot does
- Gives the containment steps one at a time, in plain words, for you or your IT provider.
- Keeps the timeline: what happened, when you became aware, what was done.
- Works out each duty to notify (data protection authority, people affected, NIS2, insurer, customers), with the deadline.
- Drafts every notification, factual and in the recipient's language.
- Records the breach in the register, notified or not, with the reasoning.
What your team does
- Act on the steps, or have your IT provider act on them.
- Make the calls: your insurer's hotline, a response firm, the police.
- Decide and send each notification, with counsel when the case is borderline.
The first hour
Containment comes before paperwork. QoBot gives one step at a time, adapted to what happened and to who’s at the keyboard:
- Contain: disconnect the affected machine from the network, reset the exposed passwords, remove the attacker’s access (a forwarding rule, an unknown device). Don’t wipe or reinstall yet: you’d destroy the evidence.
- Call the right people: your IT provider, your insurer’s hotline if your policy has one, an incident response firm for ransomware. In France, 17Cyber guides victims 24/7 and routes companies to their regional response centre.
- Write down the times: when it started, when you became aware, what was done. The legal clocks run from the moment you became aware.
Who must be told, and by when
One incident can start several clocks, each with its own recipient.
| Who | When | Deadline |
|---|---|---|
| Data protection authority (CNIL in France) | Personal data breached, unless it’s unlikely to put people at risk | 72 hours after becoming aware, where feasible |
| The people concerned | The risk to them is high | Without undue delay |
| CSIRT or competent authority (NIS2) | You’re in scope and the incident is significant, once your national law applies | 24 h early warning, 72 h notification, final report within a month |
| Your insurer | Per your policy | Per your policy; in France, a payout for a cyberattack requires a police complaint within 72 hours |
| Your customers | Per your contracts | Per the clause, sometimes 24 hours |
QoBot computes each deadline from your awareness time, shows the time left, and drafts each notification. It never invents a deadline: if a clause or a policy isn’t in your workspace, it asks you for it.
Every breach goes in the register
Under GDPR, you record every personal data breach, notified or not: what happened, its effects, what you did, and why you decided to notify or not. QoBot keeps that record in the incident file, so the reasoning is there when someone asks.
Prepare before it happens
The best time to plan an incident is a quiet week. QoBot writes a one-page incident response plan with names, phone numbers and the notification table above, and keeps it up to date with you when people, tools or contracts change.
FAQ
Do we have to notify the data protection authority?
If personal data was breached and the breach isn't unlikely to put people at risk, yes: within 72 hours of becoming aware of it, where feasible. If it's unlikely, you don't notify, but you still record the breach and your reasoning in your register.
Ransomware, but no data was stolen. Does it count?
Yes, it can. Personal data that becomes unavailable is a personal data breach too, so assess it like any other. NIS2, your insurer and your contracts may also apply.
Can QoBot send the notifications?
No. QoBot drafts them and computes the deadlines; a person at your company decides and sends.
Does QoBot replace an incident response firm?
No. For ransomware or an attacker still inside, call professionals: your insurer's panel, a provider referred by 17Cyber in France. QoBot prepares the handoff so they start fast.
Sources
- Regulation (EU) 2016/679 (GDPR), articles 33 and 34EUR-Lex · notifying the authority, informing the people concerned, the breach register (art. 33(5))Official text
- Directive (EU) 2022/2555 (NIS2), article 23EUR-Lex · 24 h, 72 h and 1 month reporting for significant incidentsOfficial text
- French Insurance Code, article L12-10-1Légifrance · police complaint within 72 hours for a cyberattack payout (France)Official text
- CNIL: notify a personal data breachFrench data protection authority · online notificationOfficial page
- 17CyberFrench national help service for victims of cyberattacks, 24/7Official page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error