WEBINAR | October 29, 2026 | Handling Security Incidents and Protecting Personal Data: How to Assess Risk and Meet the 72-Hour Deadline?
Dear Sir or Madam,
Ransomware attacks, database breaches, and compromised email accounts now affect companies of all sizes, and the number of cyberattacks on Polish organizations is steadily rising. After each such incident, the data controller has 72 hours to assess the risk and decide whether to report the breach to the President of the Personal Data Protection Office (UODO) and whether to notify the data subjects.
An incorrect assessment can be costly—the UODO regularly imposes fines simply for failing to report a breach, even when the data controller has conducted its own analysis and deemed the risk to be low.
During the webinar, we will demonstrate how to assess the severity of a breach using the ENISA method and how the UODO verifies this assessment, using examples from its decisions. We will also discuss when the same incident must be reported simultaneously under the Act on the National Cybersecurity System and the Cyber Resilience Act.
During the webinar, Kamil Kozioł—a lawyer at Andersen in Poland—will guide you step by step through the self-identification process—from understanding the criteria, through the most common mistakes in assessing status, to how to register on the list and the consequences of failing to do so.
Date: October 29, 2026
Time: 10:00 a.m.
AGENDA
- Opening: Welcome, case study—a ransomware attack on a software provider
- Incident, data breach, GDPR violation—How they differ and what this implies, live survey
- Incident response process: The first 72 hours, breach register, the role of the data processor
- Risk Assessment Using the ENISA Method – Formula and scales, joint calculation using examples from UODO decisions, common mistakes
- Reporting and Notification in UODO Practice – Content of reports and notifications, exceptions, penalties for failure to report
- Incidents at KSC and CRA – Deadlines and recipients of reports, case study solution
- Summary – Ten things to check; how we can help
- Questions – Answers to participants’ questions
This webinar is intended for individuals responsible for personal data protection in companies, data protection officers, and compliance specialists. The webinar will be recorded. We will make the recording available to participants who complete a short survey after the session.