Do we still have to report an incident that is already resolved?

Yes, if it was significant or involved a personal data breach that must be notified; fixing it does not remove the duty. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23 attaches the reporting duty to a significant incident, whether or not it is still ongoing, and the deadlines run from when you became aware of it. If you discover only now that last month's outage was an attack, the clock starts at that discovery, and you should report promptly, explaining the timeline. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., a breach that is likely to result in a risk to people must be notified even if it has been contained; containment may lower the risk and affect what you write. A resolved incident can usually go straight to a combined notification with the facts already known, but follow your authority's format. Record the dates of occurrence, awareness and resolution separately.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics