The forensic picture is incomplete — how do you decide a personal-data breach notification duty has arisen?

## The question is when you know enough, not when you know everything The single most common mistake in this decision is waiting for the forensic report. A determination that a notification duty has arisen is not the conclusion of an investigation; it is a judgement made partway through one, on the facts then available, and it is expected to be made quickly. Three findings are usually sufficient, and none of them requires a complete picture: 1. **A security incident occurred** — a control failed, an account behaved in a way the organisation did not authorise, data moved somewhere it should not have. 2. **Personal data was within its reach** — the objects, the store or the mailbox involved held personal data. You establish this from the data, not from an assumption about the system. 3. **Access is established or cannot be excluded** — either you hold a retrieval record, or you have exposure with no trustworthy read-level telemetry across the window. What you explicitly do **not** need: the number of affected individuals, the root cause, the identity or motive of the actor, confirmation that the data has been misused, or the completion of eradication. Each of those refines the notification; none of them gates the determination. ## The clock and the investigation run together, not in sequence Regimes differ on what they call the trigger, but they share a structure: a period during which you are expected to investigate with reasonable speed, and a point of awareness after which a deadline runs. The consequence that matters operationally is that **not investigating is not a way to stay unaware**. If a reasonable responder with your telemetry would have reached the determination a week earlier, that week is not free. This is why a case with a two-day pause waiting for outside forensics to be retained is dangerous — the pause is visible in your own ticket history, and it is exactly what a regulator asks about. The practical implication is to run two workstreams in parallel from the moment the incident looks like it touches personal data: the forensic thread, and a notification-readiness thread that assembles the draft, identifies the recipients, and prepares the scope statement. If the determination lands, you are hours from filing rather than days. If it does not, you have lost a modest amount of effort and gained a documented decision record. ## Make the determination an artefact The determination should exist as a short, dated, named-owner memo, written at the time and never backdated. It records: - the facts relied on, each tied to its source; - the material facts still unknown, and why — telemetry absent, retention exceeded, analysis in progress; - the conclusion reached and the standard applied; - what new fact would change the conclusion in either direction; - who made the call, and who was in the room. That last clause matters because the decision is rarely made by the responder alone: privacy, legal and the business are in it. The memo protects everyone by distinguishing *what was known* from *what was later learned*, which is precisely the distinction a later correction depends on. ## The pressures you will feel, and how to hold the line - **Wait until we are sure.** Certainty is not the standard, and it usually arrives after the deadline. The counter is to name the standard out loud and show that the three findings are already met. - **We have no evidence of access.** Test whether that means *we looked with adequate telemetry and found nothing* or *we had nothing to look at*. Only the first is a finding. The second is the cannot-exclude case, and stating it as the first is the sentence that later reads as misleading. - **Reporting an incomplete picture will look bad.** A prompt notification saying `this is what we know as of today, the review continues` is a normal filing. A late one accompanied by a complete picture invites the question of when you first knew. - **Do not write that down.** Contemporaneous factual records are the basis of every defensible determination. How legal advice is handled is a matter for counsel; the facts, their sources and their timestamps still have to be captured while they are recoverable. ## When the answer is genuinely unknown at the deadline Sometimes the deadline arrives with the retrieval question still open — for instance, a slow transfer to a destination you cannot reach, where retention no longer covers the first half of the window. The answer is to notify on the incomplete picture and say so precisely: the categories of data involved, the scope identified to date and the method by which it was identified, the part of the window your telemetry no longer covers, and the commitment to supplement. Silence is not a neutral option, and a determination deferred because the picture was untidy is the one you will have to defend hardest. ## What good looks like A candidate who answers this well says the standard out loud, separates the three findings from the many facts that do not gate the decision, insists that the investigation and the notification workstream run in parallel, and treats the memo as a deliverable of the incident rather than paperwork after it.