The First 72 Hours: A Playbook for Transatlantic Incident Response

For companies operating across Europe and the United States, a data incident can trigger very different regulatory obligations at the same time. The GDPR’s 72-hour framework may require decisions before the facts are fully established, while the U.S. patchwork of notification requirements can quickly expand the scope of the compliance analysis.

AI is making that challenge more acute, enabling more frequent and sophisticated attacks while increasing the potential speed, scale, and reach of the incident.

This session will examine the critical regulatory decisions companies face in the first days of a transatlantic incident. We will compare EU and U.S. notification requirements and explore how companies determine which regulators and individuals must be notified, when notification is required, and how to proceed when the investigation is still developing. We will also consider the challenges that arise when an incident spans multiple jurisdictions and corporate entities, including how to coordinate the teams responsible for reaching and implementing those decisions.

What you will learn:

• Map the regulatory landscape. Learn how to identify which EU and U.S. breach regimes apply based on the entities, individuals, data, and jurisdictions affected.
• Make defensible notification decisions. Understand how EU and U.S. requirements for notifying regulators and individuals differ, including notification thresholds, timing, and managing uncertainty while the investigation develops.
• Mobilize a multinational response. Understand how corporate structure shapes incident response, including identifying the entities with notification obligations and coordinating the legal, privacy, security, and business teams needed across different parts of the organization.