In a data breach, the first hours decide whether a company acts in an orderly way or improvises. Deadlines are short, information is incomplete, and several parties want answers at once: customers, authorities, management, insurers. A playbook is the preparation that relieves those hours. The steps during the incident itself are in our checklist for the first 72 hours; this article covers what must be in place beforehand.
Roles before they are needed
A playbook starts with names, not processes: who leads the incident, who decides on notifications, who assesses the technology, who drafts communication, who talks to customers, who provides external support for forensics and legal? Each role needs a deputy and current contact details that remain reachable even if email and internal systems are affected. In small companies one person takes several roles; then it must be clear which external party steps in.
The decision matrix
The hardest question in an incident is whether notification is required. A prepared matrix helps: which data types do we process in which systems, which are sensitive, which legal systems apply? Under the Swiss FADP, the FDPIC must be informed as soon as possible where a high risk is likely; under the GDPR, the competent supervisory authority where feasible within 72 hours, unless a risk is unlikely. Companies without an EU establishment do not benefit from the lead-authority principle and must clarify which authorities are competent. Answering these questions per system in advance means deciding in minutes rather than hours during an incident.
Templates
Nobody writes good text under time pressure. Prepared templates save time and errors: a notification to the FDPIC and EU supervisory authorities with the mandatory details, a notice to data subjects in plain language, a notice to business customers, an internal situation report with fixed sections and a holding statement for media enquiries. Templates are frameworks, not finished texts: they ensure nothing is missing, not that everything sounds the same.
Communication as a processor
For SaaS providers one feature is central: for their customers’ data they are usually processors. They must inform their customers, as controllers, as soon as possible, and those customers have their own notification duties with their own deadlines. Customer communication must therefore be fast, factual and concrete enough for each customer to make its own assessment: which data, which period, which tenant, which measures. Contracts should set communication channels and timings in advance.
Other notification duties
Data protection is not the only reporting route. Operators of critical infrastructure in Switzerland have had to report cyberattacks to the Federal Office for Cybersecurity within 24 hours since April 2025. Supervised financial institutions have reporting duties to FINMA, and in the EU incident reporting under DORA applies. Insurers often require prompt notice. The playbook lists every reporting route applicable to the company, with deadlines and owners.
Documentation
Under the GDPR, all breaches must be documented, including those not requiring notification, with facts, effects and measures. The Swiss Data Protection Ordinance requires documentation kept for at least two years. A simple incident register with fixed fields meets both and is also the basis for learning from incidents. The reasoning for not notifying matters too.
Drills
A playbook never rehearsed fails on small things: outdated phone numbers, unclear access, templates nobody can find. An annual drill on a realistic scenario, such as a compromised admin account or a misdirected customer list, reveals these gaps. It takes a few hours and is the cheapest measure there is.
Building it in four steps
1. Define roles, deputies and emergency contacts and store them outside your own systems.
2. For each system, record data types, legal systems and reporting routes in a matrix, based on the record of processing activities.
3. Prepare templates for authorities, data subjects, customers and media.
4. Set up an incident register and drill annually.
The duties in detail are explained in the glossary entry on data breach notification. We support building such a playbook as part of our revised FADP implementation for SMEs.