Data breach readiness: playbook, notification process and drill
Swiss SMEs and SaaS providers processing personal data that have no rehearsed process for data breaches yet.
Updated: 2026-10
Data breach readiness gives you a ready-to-use playbook: named roles and emergency contacts, a decision matrix per system for notification duties under the FADP and GDPR, templates for authorities, data subjects and customers, an incident register and a guided drill. In an emergency you decide in minutes instead of hours.
In a data breach, deadlines run from the moment the company becomes aware: 72 hours under the GDPR, as soon as possible under the Swiss FADP. Clarifying only during the incident who decides, which data is affected and who must be informed loses exactly that time.
SaaS providers are, in addition, usually processors for their customers’ data. They must inform their customers quickly and concretely so those customers can meet their own duties. Without prepared channels and texts, this communication comes under pressure.
What you get
Roles and emergency contacts
Named owners for leadership, decision, technology, communication and external support, with deputies and contacts reachable even when systems are down.
Decision matrix per system
For each system with personal data: data types, sensitive data, applicable law and the reporting routes under the FADP, the GDPR and any other obligations.
Templates
Notifications to the FDPIC and EU supervisory authorities with the mandatory details, notices to data subjects and business customers, an internal situation report and a holding statement for media.
Incident register
A simple register with fixed fields that meets documentation duties, including for incidents not requiring notification.
Guided drill
A tabletop exercise on a realistic scenario with the core team and a written evaluation with concrete improvements.
How it runs
- 1
Inventory
Record systems, data types, processors and existing processes, based on the record of processing activities where available.
- 2
Matrix and templates
Create the decision matrix and templates and agree them with the owners.
- 3
Drill
Run the scenario, record gaps, adjust the playbook.
- 4
Handover
Store playbook, register and templates in one place, secured outside your own systems.
Price framing
Fixed price by scope. The range depends on the number of systems and legal systems and is set in a short initial conversation — with no hidden follow-up costs.
Indicative, not a binding quote — the frame is confirmed during scoping.
What drives the price? → Cost guide
Parent service: Data Protection Consulting
FAQ
Does this replace a forensic investigation in an emergency?
No. The playbook governs decisions, notifications and communication. For attacks, technical investigation belongs with specialised incident response providers; the playbook defines when and how they are brought in.
Does this apply to companies subject only to the FADP?
Yes. The matrix is tailored to the rules that actually apply. Companies also subject to the GDPR get both reporting routes.
Is this legal advice?
It is the organisational implementation of the duties. For legal assessments in individual cases a specialised law firm should be involved; the playbook provides for that step.
How often should we drill?
At least annually and after major changes to systems or organisation. The evaluation of the first drill shows where to sharpen.
Data breach readiness: playbook, notification process and drill
Swiss SMEs and SaaS providers processing personal data that have no rehearsed process for data breaches yet.