From 06d4787d9a6341ee8ec4d1b1603ef814b2fc17bd Mon Sep 17 00:00:00 2001
From: Nina Seidel <n.seidel@nexus.local>
Date: Tue, 28 Apr 2026 14:00:00 +0000
Subject: [PATCH] Incident response: add GDPR 72h notification requirement

---
 procedures/incident-response.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/procedures/incident-response.md b/procedures/incident-response.md
index 669e712..23ced81 100644
--- a/procedures/incident-response.md
+++ b/procedures/incident-response.md
@@ -26,3 +26,9 @@
 - SOC hotline: +49 69 123 456 (24/7)
 - CISO: direct mobile (see 1Password "emergency contacts")
 - Legal: legal@nexus.local
+
+## Regulatory notification requirements
+
+For incidents involving personal data, the supervisory authority (BfDI) must be notified
+within **72 hours** if the breach is likely to result in a risk to individuals.
+Contact DPO immediately upon any P1 involving customer data.