A data breach is also a legal event: separate the notifications

The decision behind the headline

This review focuses on personal-data exposure, risk assessment, controller duties and regulatory notification.

In the recruitment example, record which CV fields were exposed, whether sensitive information was included and how long public access lasted. Investigate whether downloads can be established without interpreting a lack of logs as proof that nobody accessed the records. The risk assessment should consider potential consequences for individuals, not only the agency’s reputational inconvenience. Have the responsible legal and technical people update one factual chronology as the investigation develops, so that the notification reasoning remains consistent with the available evidence.

A hypothetical scenario to test

A recruitment agency discovers CVs with personal details publicly accessible after a configuration error. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

A proposed cyber service should explain who supports that assessment, drafts communications and helps restore permissions. Ask whether the insurer approves outside privacy counsel and whether notification expenses have a dedicated limit. Keep an explicit distinction between the technical event, the statutory analysis and the compensation claim. A notification can be necessary before the financial scope is fully known. Conversely, a dramatic headline does not establish that every affected person faces the same risk.

Identify the contractual boundary

Swiss data-breach reporting is not a universal 72-hour rule. FDPIC guidance says a controller must notify the FDPIC as soon as possible where the breach is likely to create a high risk to personality or fundamental rights. A processor must inform its controller of a data-security breach regardless of that high-risk threshold. Information to affected individuals is a separate question under the Act. Have qualified counsel assess the facts and preserve the reasoning; notifying your cyber insurer does not fulfil these obligations. Lost availability can be a data-security issue even where no theft has yet been demonstrated. Assess what happened to confidentiality, integrity and availability, and update the assessment as evidence arrives. Do not delay the applicable notification analysis merely because the technical investigation is unfinished.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of privacy counsel, notification costs, forensic assistance and liability limits. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to limit permissions and prepare a documented risk-assessment process with qualified counsel. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare data categories, affected individuals, exposure duration, access evidence and decisions. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.