Breach Tabletop: A Live Incident Run Against the 72-Hour Clock

Presenters

Richard Chudzynsky

Partner, KONEXO/Eversheds Sutherland

Skanda Reddy

Senior Associate, KONEXO/Eversheds Sutherland

Aben Pagar

Head of Digital Risk Consulting, KONEXO/Eversheds Sutherland

Session overview

This session will run a simulated personal data breach live against the 72-hour clock that applies, under the current Implementing Regulation, where a breach may cause harm. An incident team will work through triage, the awareness timestamp, harm assessment, the SDAIA notification, the data subject decision and sector regulator overlays, with the audience voting at each decision point. It will also cover SDAIA's October 2026 draft amendments, which would make notification to SDAIA independent of the harm assessment.