Before the Seventy-Two Hours: Contracting Who Notifies Whom After a Cyber Incident
A cyber incident exposes contractual ambiguity faster than it exposes data. This article sets out how advisory firms and their clients can allocate UK GDPR and sector-regulator notification duties before an incident, with practical drafting points on timelines, privilege, evidence preservation and vendor coordination.