LegalAI[Space]

A personal data breach, the 72-hour assessment

An export containing HR records for 214 people was sent to the wrong address. The Article 33 clock started at awareness, and the assessment has to be defensible within the 72-hour window, whichever way the decision goes.

Data and privacy · Privacy team, DPO, general counsel, supervising partner

Start freeBook a walkthrough
Agents
Research, Privacy & Data Protection
First draft
A grounded research answer in under a minute, then a Regulator Response assessment signed off within the hour.

The problem

The 72-hour trigger runs from awareness, not from full certainty about scope, and the decision on notifying data subjects under Article 34 depends on a high-risk assessment that has to be reasoned, not asserted, in the document the regulator will read.

  1. Step 01 of 05

    Open the matter and record the clock

    Awareness and the Article 33 deadline go on the matter as key dates; the incident note, the export manifest, the mail log and the firm's own board minutes are added.

    Matters · Project Halcyon · SPA warranties and disclosureOpen

    Project Halcyon: SPA warranties and disclosure

    Buy-side warranty review, disclosure analysis and cited due-diligence grid.

    Client
    Halcyon Bidco Ltd
    Reference
    WC-2026-0412
    Practice area
    Corporate / M&A
    Jurisdiction
    England and Wales
    Responsible partner
    E. Vance
    No conflict check on file.

    Chat, on this matter

    Compare warranties with the disclosure letter.

    Three high-priority exceptions require action: the unregistered charge, the change-of-control right and the tribunal claim.

    Send a message… (@ to mention tools)BalancedPrepare for
    1. 25 Aug

      Disclosure exceptions matrix

      Chat

    2. 21 Aug

      Disclosure exceptions matrix

      Run · completed · 560 credits

    3. 18 Aug

      Project Halcyon: Disclosure Letter

      Document · indexed

    4. 16 Aug

      Project Halcyon: Share Purchase Agreement

      Document · indexed

    5. 4 Aug

      Matter opened

      Opened

  2. Step 02 of 05

    Ask the assessment question

    The 72-hour trigger, the phased notification allowance under Article 33(4), and the Article 34 threshold for telling the individuals are set out against the specific data categories involved.

    Matters · 14 Rowan Court, Flat 9 · ResearchSources ranked
    Matter: 14 Rowan CourtEngland and WalesResearch Agent
     
    Prepare for: Court-Ready · Deliver as: Word

    Where we looked

    • 1Your documentsLease, demand, correspondence
    • 2Primary law3 statutes, 1 judgment
    • 3Regulators and the recordNothing needed
    • 4Web searchOff for this question

    Authorities · 4

    • 1

      Law of Property Act 1925, s 146

      c 20
      not yet checked
    • 2

      Housing Act 1996, s 81

      c 52
      not yet checked
    • 3

      Commonhold and Leasehold Reform Act 2002, s 168

      c 15
      not yet checked
    • 4

      Escalus Properties Ltd v Robinson

      [1996] QB 231 (CA)
      not yet checked

  3. Step 03 of 05

    Produce the assessment

    The Privacy & Data Protection Agent runs with Prepare for: Regulator Response, covering the chronology, the risk assessment, the notification recommendation and the Article 33(5) record entry.

    Agents · Contract Agent · New runMatter: Northgate · senior associate hire

    Agent

    Jurisdiction

    Prepare for

    Deliver as

    Instruction

    What should the agent look for?

    Documents

    Drop a contract, or pick one from the matter

    Also on the matter

    • Offer_letter_v3.pdf2 pages
    • Staff_handbook_2025.docx61 pages
    • Board_minute_14_Aug.pdf3 pages
    Platform model · zero data retention · audit register on

  4. Step 04 of 05

    Read the recommendation

    Notify the ICO by the deadline, communicate to the affected individuals under Article 34 prioritising the special-category data subjects, and do not wait for the recipient to respond.

    Agents · Contract Agent · Employment Contract Compliance ReviewCompleted
    6 items need your confirmation14 authorities · Where we looked

    Senior Associate Employment Contract: English Law Review

    Summary

    1. 1.

      Clause 9(c), non-competeHigh

      The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.

      Tillman v Egon Zehnder Ltd [2019] UKSC 32
    2. 2.

      Clause 11, data and monitoringHigh

      Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.

      UK GDPR, Arts 6 and 9
    3. 3.

      Clause 4, holiday carry-overHigh

      The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.

      Working Time Regulations 1998, regs 13 to 13A

  5. Step 05 of 05

    Sign off and share

    The partner ticks the action items, clicks Verify all, and shares the assessment with the client on a passcode link with the view logged.

    Client sharing · Employment Contract Compliance Review

    What travels

    Protection

    Six-digit passcode4 8 2 · 9 1 7
    Expires in
    share.legalaispace.com/s/k7Qm…

    View log · also written to the audit register

    1. Opened

      client@halcyon-bidco.example
      Today 09:14

    2. Downloaded memo.docx

      client@halcyon-bidco.example
      Today 09:15

    3. Failed passcode attempt

      unknown
      Yesterday 17:40

    4. Link created · expires in 7 days

      E. Vance
      Yesterday 16:02

    The reader sees your firm's name, the sections you chose, and nothing else. No sign-in, no account, no way back into the workspace.

A document, not a transcript.

  • A recommendation on notifying the ICO and on communicating to data subjects, with the reasoning against Articles 33 and 34 written out.
  • A numbered chronology and a note of the categories of data and the number of people affected.
  • Remediation action items with owners and dates, including the Article 33(5) internal record entry.
  • An unrelated compliance gap surfaced from the firm's own board minutes, an overdue subject access request.

Authorities it checks

  • UK GDPR, Art 9, Art 33, Art 34
  • Data Protection Act 2018
  • ICO guidance on personal data breaches
Every source it may cite

What it does not do

  • It does not decide the notification for the firm; the recommendation is a draft for the DPO to act on within the window.
  • It does not confirm whether the recipient has deleted the data; that is an outstanding action item, not an assumption.
  • It records the exemption reasoning rather than asserting risk is low without stating why.

Related

Run this on your own document

Free plan, two seats, no card.
Start freeBook a 20-minute walkthrough