Before the Seventy-Two Hours: Contracting Who Notifies Whom After a Cyber Incident

A cyber incident rarely begins with a clear answer to the most important question: who calls the regulator? For advisory firms handling client data, the first call after a breach should be a contractual certainty, not a scramble between client and adviser. The regulatory clock is unforgiving, and the commercial relationship is least cooperative at the moment it is most tested. The solution is not a longer incident response policy. It is a sharper contract.

Map the roles before the incident

The starting point is the controller-processor boundary. An advisory firm may be a processor for client data, a controller for its own human resources, marketing and business development records, and occasionally a joint controller in complex engagements. UK GDPR imposes different duties on each. A processor must notify the controller without undue delay after becoming aware of a personal data breach. A controller must assess whether the threshold for notifying the Information Commissioner's Office is met, and must do so within 72 hours of awareness where required.

Generic data processing clauses often blur these roles. The contract should identify the relevant data sets, state the role for each, and name the party responsible for regulatory assessment. Where the firm acts as processor, the client should not assume the firm will make the ICO notification. Where the firm acts as controller, the client should not assume it retains decision rights over the firm's own regulatory duties. Ambiguity here is not a drafting nicety. It is a delay mechanism.

The notification chain: from detection to decision

Contracts frequently require notification immediately or as soon as practicable. Those phrases provide little operational guidance. A workable clause sets out a chain. It should identify who detects, who escalates, who assesses and who decides. A useful structure is an initial alert within a short window, followed by a formal incident notice with known facts, affected data categories, likely regulatory implications and the parties' proposed next steps. A joint incident call should follow within a defined period.

The clause should also address out-of-hours detection. Cyber incidents do not respect office hours, and an escalation route that depends on a single account manager is not a route. Named contacts, backups and a shared incident log are basic controls. The contract need not prescribe the entire response plan, but it should require one and incorporate it by reference where appropriate.

Regulator clocks and sector overlays

UK GDPR is not the only clock. Firms regulated by the Financial Conduct Authority, the Solicitors Regulation Authority or a professional body may have separate notification obligations. Those obligations may arise independently of the client's view. A contractual notification protocol cannot override a statutory or regulatory duty. The clause should say so expressly: nothing in the agreement prevents a party from meeting its own regulatory obligations, including making a notification without the other party's consent where required.

That carve-out is not a licence for unilateral communication. It should sit alongside a requirement to consult where practicable, to share the substance of any notification before it is made where time allows, and to inform the other party promptly afterwards. The aim is coordinated compliance, not collective paralysis.

Privilege and evidence preservation

Early legal involvement is valuable, but privilege is not automatic. A factual investigation conducted by business teams may not attract legal professional privilege merely because lawyers are later copied in. The contract should require preservation of logs, devices, mailbox records, access records and communications relevant to the incident. Routine deletion policies should be suspended under a documented hold.

The clause should also address the handling of forensic reports. If a vendor is engaged, the engagement terms should support confidentiality and, where appropriate, privilege. The parties should agree who instructs forensic advisers, who receives the draft report and how findings are shared with regulators. Evidence preservation is not an administrative afterthought. It is often the difference between a defensible position and an unexplained gap.

Vendor coordination

Advisory firms rely on cloud providers, managed service providers and specialist forensic vendors. Those relationships need flow-down obligations. A vendor should notify the firm within a defined period, provide sufficient information for the firm to meet its own duties, and refrain from contacting regulators or affected individuals on the firm's behalf unless authorised. Statutory duties still prevail, but the contract should make the default route clear.

The same discipline applies to subprocessors. A chain of notification that passes through three suppliers before reaching the client is not a notification chain. It is a delay. The contract should identify the point of contact for vendor escalations and require the firm to pass on relevant information without waiting for a complete picture.

Drafting the clause: practical terms

A breach notification clause should define an incident by reference to actual or suspected unauthorised access, loss or disclosure. It should define awareness in operational terms. It should set out initial and formal notification windows, the content of each notice, the frequency of updates and the consequences of failing to notify. It should address costs, cooperation, media handling and public statements. It should require a post-incident review and a record of decisions.

Most importantly, it should identify the decision-maker for each regulatory notification. Where the client is controller, the client decides on ICO notification, but the firm must supply the facts. Where the firm is controller, the firm decides, but the client may need to be informed. The clause should reflect those distinctions rather than flattening them into a single mutual obligation.

Test the clause, not just the policy

A notification clause that has never been tested is a hypothesis. Firms should run a tabletop exercise with client representatives, test out-of-hours contacts, and walk through a scenario in which the firm and the client disagree about whether the threshold is met. The exercise should produce a decision log and a list of contractual fixes.

Cyber incidents expose the quality of a commercial relationship. They also expose the quality of its paperwork. The first call after a breach should be a contractual certainty, not a negotiation. For UK advisory firms, the time to settle who notifies whom is before the seventy-two hours begin.