When an incident hits a fintech group: from the first hour to the regulator's final report

Each rule anchors its count to a different event:

• GDPR and UK GDPR: 72 hours from the controller becoming aware of a personal data breach.
• DORA: 4 hours from classifying an ICT incident as major, and no later than 24 hours from awareness.
• RPAA (Bank of Canada): 48 hours after the PSP determines the incident is material.
• NYDFS Part 500: 72 hours after determining an incident occurred, including at a vendor.
• PDPA (Singapore): 3 calendar days after assessing the breach as notifiable.
• FTC Safeguards Rule: 30 days after discovery when 500 or more consumers are involved.

So our first document is a timestamped log of when the event was noticed, classified and assessed; every notice draws on it.

1. Containment. Disable compromised accounts and keys, isolate affected servers, close the entry point.
2. Evidence. Capture logs, images and snapshots before any rebuild, and record the chain of custody.
3. Scope. Which systems, which data categories, how many customers, which operations stopped. For a KYC data breach we list separately: passports, selfies, addresses, account numbers.
4. Classification. For each jurisdiction in the group, whether the notification threshold is met and when the clock started.
5. Drafts. Notice texts built on established facts. GDPR expressly allows information to be provided in phases when it cannot all be gathered at once (Art. 33(4)).

The decision to notify stays with you, your DPO and your lawyer; we give them reliable facts.

The notice describes the nature of the breach, the categories and approximate numbers of people and records, the DPO contact, likely consequences and measures taken (Art. 33(3)). After 72 hours it must give reasons for the delay. A processor, such as your KYC vendor, informs the controller without undue delay (Art. 33(2)).

United Kingdom

UK GDPR keeps the 72-hour deadline. Since 30 September 2026, Article 33 names the Information Commission, the ICO's successor, as the recipient.

A log of every breach

Every breach is documented, notified or not: facts, effects and remedial action (Art. 33(5)). Canada's PIPEDA rules keep such records for 24 months. We build the log as we work.

The deadlines are set by Commission Delegated Regulation (EU) 2025/301. Where an incident is classified as major more than 24 hours after awareness, the initial notification is due within 4 hours of classification (Art. 5(2)).

For an EU-licensed EMI or payment institution this is the tightest deadline in the group, so classification criteria and a notice template must exist beforehand. We check your plan has both and rehearse a scenario where the DORA and GDPR clocks start together. For the security of personal data itself, see our data protection page.

The report covers the timeline, entry point, affected systems and data, containment and recovery steps, measures put in place and the date of the re-check. A short version in plain language goes to management and the bank; a technical annex goes to the regulator and auditor.

Afterwards we update the response plan with where time was lost, and any later bank questionnaire is answered from the same report.