Legal, Ethical, and Reporting Obligations
Know your obligations before you need them
Obligations arrive from four directions: regulatory (GDPR, HIPAA, NIS2, sector rules), contractual (customer agreements, SLAs, NDAs, insurer terms), statutory breach notification to individuals and authorities, and internal policy. Know which apply to the data involved, not merely to where the server sits.
Representative timelines: GDPR requires notifying the supervisory authority within 72 hours of becoming aware; HIPAA generally requires individual notification within 60 days of discovery; PCI DSS requires prompt notification to the acquirer and card brands; NIS2 uses staged reporting beginning with an early warning within 24 hours. Confirm specifics with counsel - the exam tests that you know a clock exists and when it starts.
Evidence and ethics
Evidence must survive scrutiny: chain of custody, hashing, documented handling, and restricted access. Investigations should collect the minimum personal data necessary. Monitoring must rest on policy and, where required, consent or works-council agreement. Insider cases require coordination with HR and legal before touching employee systems. Hack-back is not an option - retaliation is unlawful in most jurisdictions and escalates risk. Work only within the authorized scope defined by rules of engagement and letters of authorization.
Traps
Starting the notification clock at full scoping rather than at awareness. Assuming law enforcement decides whether you notify regulators. Investigating an employee's device without legal authority. Sharing personal data with third parties without an agreement in place. Confusing voluntary reporting with a mandatory obligation.
Rule of thumb
Engage legal at declaration, not at reporting time, and start every notification clock at awareness.