Unauthorised access to an ad account, a customer list sent to the wrong place or a tag that shares data it should not are data incidents. The response in the first 24 hours makes the difference: contain, assess, inform those who need to know and correct. Having a simple plan avoids panic and mistakes.
The essentials in a definition
A data incident in ad accounts (unauthorised access, list leak, compromised credentials) requires a fast, organised response. A 24-hour plan defines who does what: contain, assess, notify where required and fix. The GDPR provides notification deadlines in certain cases, the CNPD guides the procedure, and NIST provides risk-management references.
What an incident is
Any situation in which personal data is lost, accessed, altered or disclosed without authorisation: compromised accounts, emails sent by mistake, files shared publicly, integrations that expose data, badly configured tags. Some incidents carry obligations to notify authorities and affected people.
Not every mistake is an incident, but it pays to assess.
The first hours
Contain: revoke access, disable integrations, remove files, pause campaigns, change passwords. Record: what happened, when, who, what data and how many people. Inform internally whoever decides (management, data-protection lead). Preserve evidence.
Avoid deleting without recording.
A 24-hour incident response plan
- Contain: revoke access and pause what is needed
- Record what happened and preserve evidence
- Assess severity and notify where required
- Fix the cause and review the plan
Assess and notify
Assess severity: type of data, number of people, likelihood of harm. In many cases there is an obligation to notify the supervisory authority within a short period (for example 72 hours from awareness) and, if the risk is high, the people affected. Seek legal and data-protection support immediately.
Communicate clearly and without downplaying.
In an incident, speed of response weighs more than perfection.
Correct and learn
Resolve the cause (access, processes, tools, training). Update contracts and records. Review the plan. Run an annual simulation. Keep an incident log, even of small ones, to spot patterns.
A good response strengthens trust.
Decision table
| Phase | Action | Indicative time |
|---|---|---|
| Contain | Revoke access, change credentials, pause what is needed | First hours |
| Assess | What data, how many people, what risk | First day |
| Notify | Authority and data subjects, when required | According to legal deadlines |
| Fix and learn | Cause, measures and plan update | Following days |
Common mistakes to avoid
- Having no plan. Improvising delays containment.
- Hiding the incident. It can worsen legal and trust consequences.
- Not recording. Always record what happened and decisions taken.
How to measure the result
Test the plan with annual drills and measure containment, assessment and communication times.
Limits and exceptions
Each incident is different, and notification obligations depend on risk and type of data. This content is informational and not legal advice. In case of an incident, seek specialist support immediately and document decisions. Prevention (access, training, minimisation) greatly reduces probability and impact.
Illustrative example
Illustrative example: a company discovers a supplier credential was compromised. It follows the plan: revokes access, changes passwords, checks change history, assesses which lists were exposed and notifies the relevant parties within deadlines. Afterwards, it strengthens authentication and training. The incident is managed in days, with a clear record.
In practice: checkpoints
Prepare a simple plan before anything happens: who decides, who is notified, how to cut access, how to preserve evidence and how to communicate. In the first hours, revoke suspicious access, change credentials, check what data was exposed and notify the person responsible for data protection. Legal deadlines may apply, so keep contact details of advisers at hand, and rehearse the plan once a year. Record the incident and what you learned, and review account security as a result.
Frequently asked questions
Whom should I tell first?
Whoever decides in the company and whoever handles data protection, to assess notification.
Are there notification deadlines?
In many cases yes, and they are short. Seek support immediately.
Should I run simulations?
Yes, once a year, to test the plan.
When is notification mandatory?
In certain personal-data breaches, within defined deadlines; consult the rules and the supervisory authority.
Who should be in the plan?
Data protection officer or equivalent, IT, marketing, legal and management.
Have a 24-hour response plan (contain, assess, notify and fix), with owners and contacts defined, and test it regularly.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- Portuguese Data Protection Authority (CNPD)
- NIST: AI Risk Management Framework
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.