Services
Security Incidents
When a security incident is discovered — a break-in, a data leak, ransomware or an email sent to the wrong person — we stay with you from the first hour: what to do, whom to report to, and what to say. Before it happens, we prepare an incident procedure so you know what to do. Security incident happening now? Call — don’t describe it in writing.
Four questions that decide what you must do
After an incident, the answers to these questions decide whom you must report to, and when.
| # | Question | Why it is decisive |
|---|---|---|
| 1 | Which security level is the database at? | If the database is at the medium or high security level and a serious security incident occurs in it — you must report to the Privacy Protection Authority immediately. At every security level, each event that raises a concern must be recorded. |
| 2 | When did you learn of the incident? | According to the Privacy Protection Authority, the duty to report a serious security incident arises when you become aware of it, not after an internal investigation. The Privacy Protection Authority has already imposed a NIS 256,000 monetary sanction for not reporting promptly. |
| 3 | Does the GDPR apply to you too? | If so, a second clock runs: notifying the EU supervisory authority within 72 hours, where feasible. |
| 4 | What do your insurance policy and contracts say? | An insurance policy and customer contracts often set notice deadlines of their own, and immediate notice to the insurer can be a condition of cover. |
When an incident happens
After the first call, the work follows the incident’s clock.
- The call
- You call, and we start at once: what happened, what has already been done, and who needs to be involved.
- The first hour
- Containment without deleting evidence: disconnecting, blocking and changing passwords, and a record from the first minute — what happened, when it was found and who is involved.
- The first day
- The scope: what data was exposed, and about how many people. The decision whether the duty to report immediately applies, the report to the Privacy Protection Authority, and notice to your insurer under the policy.
- The first week
- Notices to customers, regulated bodies and the people affected, where required and in agreed wording. A review of what happened, and your procedures updated with the lesson.
- 1. The call
- 2. The first hour
- 3. The first day
- 4. The first week
Before it happens
Preparing in advance shortens the first hours. These deliverables get you ready for an incident before it happens.
| Deliverable | What it contains |
|---|---|
| Incident procedure | Reporting procedure, a decision table for who reports to whom and within what time, and a pre-drafted preliminary notification. |
| Statement to the public and customers | A draft ready in advance: what happened, what you are doing and whom to contact, in wording that matches what you report to the Privacy Protection Authority and your insurer. |
| Incident log | A record of every event that raises a concern, as the Data Security Regulations require, and a template ready to fill in. |
| Incident exercise | An exercise with management and staff, on a scenario from your own business. |
| Management briefing | One session with management or the board: what applies, what was decided, and what is minuted. |
Questions people ask
How fast must a security incident be reported in Israel?
Immediately, for a serious security incident in a database at the medium or high security level, under the Data Security Regulations. According to the Privacy Protection Authority, the duty arises when you learn of the incident: you file an initial report and supplement it later, without waiting to finish all checks. Israeli law has no 72-hour grace period.
What if the GDPR also applies?
Then a second clock runs: the GDPR requires notification to the supervisory authority within 72 hours where feasible, and a processor must notify its controller without undue delay. A single incident procedure has to answer both, plus whatever the customer contracts say.
Do we have to tell the people whose data was exposed?
Not always. The Data Security Regulations set no general duty to notify the people affected; the Privacy Protection Authority may order you to notify those who may be harmed. Professional duties, contracts and good faith can require notice separately, so the decision depends on the circumstances, and it is made with you.