# Do we still have to report an incident that is already resolved?

Yes, if it was significant or involved a personal data breach that must be notified; fixing it does not remove the duty. NIS2 Article 23 attaches the reporting duty to a significant incident, whether or not it is still ongoing, and the deadlines run from when you became aware of it. If you discover only now that last month's outage was an attack, the clock starts at that discovery, and you should report promptly, explaining the timeline. Under the GDPR, a breach that is likely to result in a risk to people must be notified even if it has been contained; containment may lower the risk and affect what you write. A resolved incident can usually go straight to a combined notification with the facts already known, but follow your authority's format. Record the dates of occurrence, awareness and resolution separately.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/can-we-report-an-incident-that-is-already-resolved

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [What reduces a GDPR fine after a data breach?](https://netsenx.com/en/faq/what-reduces-a-gdpr-fine-after-a-data-breach)
- [Can NetSenX prepare a GDPR Article 33 breach notification?](https://netsenx.com/en/faq/can-netsenx-prepare-a-gdpr-article-33-notification)
- [Does a security tool's audit log help with IT general controls?](https://netsenx.com/en/faq/does-a-security-tools-audit-log-help-with-it-general-controls)
- [How do we prove who changed a security setting, and when?](https://netsenx.com/en/faq/how-do-we-prove-who-changed-a-security-setting)
- [How do we show an auditor which parts of our network are monitored?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-which-parts-of-the-network-are-monitored)