Engagement · Breach Response Retainer

When the clock starts, you have minutes — not days.

A pre-positioned breach response retainer. Named senior practitioner on call 24/7, regulator-clock playbook tailored to your environment, communications and notification templates pre-drafted, forensics partner pre-vetted. The point is not to write the runbook during the breach — the point is to have it written six months earlier.

Active incident, existing client?

The 24/7 hotline is on your engagement letter. Use it. Read this page before you need to.

Pre-position →
Activation SLA

Senior practitioner on call within 60 minutes
24/7, including weekends & public holidays

Annual retainer

Three tiers, SAR 36k — 180k
Activation hours included or hourly

Regulator clock coverage

KSA PDPL · India DPDP · UAE PDPL · GDPR
Multi-jurisdiction notification choreography

01 — The regulator clock

Four jurisdictions. One small window.

The 72-hour regulatory clock is now mainstream across the privacy regulators that matter to you. The first hour is the most expensive: triage, scope, severity rating. By hour 24 the notification draft has to be in motion. By hour 72 — depending on jurisdiction — it has to be filed, often through a regulator-specific portal that nobody has logged into in two years.

72Hours
SDAIA
KSA PDPL

Notification to the regulator within 72 hours of becoming aware. Affected individuals notified where the breach is likely to cause harm.

ASAPwithout delay
DPDP Board
India DPDP Act 2023

Section 8(6) requires notification to the Board and to affected Data Principals "in such form and manner as may be prescribed" — without undue delay.

72Hours
UAE Data Office
UAE Federal PDPL

Article 9 requires controller notification to the regulator within 72 hours where the breach is likely to result in risk to the rights of data subjects.

72Hours
EU / UK
GDPR Art. 33

Notification to the supervisory authority within 72 hours of becoming aware. Where notification not made within 72 hours, accompanied by reasons for the delay.

Multi-jurisdiction matters most when the clocks don't agree. A KSA-headquartered group with India operations and EU data subjects faces three different clocks running concurrently — sometimes with materially different thresholds for what triggers notification at all. The retainer's job is to choreograph the notifications so the timing is right and the wording is consistent.

02 — Two halves, one engagement

Done before. Done during.

The retainer has two distinct phases. The first happens in the calm — the work that is impossible to do during a breach: tailoring playbooks to your environment, pre-vetting forensics partners, mapping internal contact trees. The second is the activation itself, where the pre-positioned work pays out.

Phase A · Pre-positioning

Done in the calm

Setup work completed within the first 4 — 6 weeks of engagement, before any incident has occurred. Refreshed annually or on material change.

A — 01

Environment briefing & named lead

Senior practitioner assigned, briefed on your data architecture, in-scope jurisdictions, internal contact tree, board reporting expectations.

A — 02

Tailored response playbook

Generic playbooks fail in real incidents. Yours is written to your systems, your jurisdictions, your sector, your board governance — not a template.

A — 03

Communications templates

Pre-drafted regulator notification skeletons, individual notification language, internal-leadership briefings, board-statement frameworks. Ready to populate when needed.

A — 04

Forensics partner pre-vetting

Forensics provider commercial terms pre-agreed (with one of three pre-vetted partners or your nominated firm). MSA executed; rate card known.

A — 05

Regulator escalation paths

SDAIA, UAE Data Office, India DPDP Board, ICO contact registries confirmed. Submission portal access verified. Sector-specific regulator overlays mapped.

A — 06

Annual exercise / drill

One tabletop drill per year (Tier 02 / 03). Runs through realistic scenario, identifies decision-tree gaps, rebuilds muscle memory in your team.

Phase B · Activation

Done in the moment

When the hotline triggers. Senior practitioner on call within 60 minutes, lead activation within 4 hours, structured response from the first call onwards.

B — 01

First-hour intake & severity

Structured intake call. Initial severity rating, scope estimation, regulator-clock activation across affected jurisdictions, internal stakeholder cascade triggered.

B — 02

Forensics coordination

Pre-vetted forensics partner brought in within 4 hours. Scope, evidence preservation, chain of custody choreographed alongside investigation.

B — 03

Regulator notification drafting

Notification populated against pre-drafted skeleton. Multi-jurisdiction divergence handled; submission timing aligned to clock requirements.

B — 04

Individual notification scoping

Affected-individual scoping based on harm-likelihood threshold per jurisdiction. Notification language drafted; channel selected (email, SMS, post, public).

B — 05

Communications support

Internal leadership briefings, board statements, customer-facing messaging, media holding statements. Coordinated with your comms or external PR firm.

B — 06

Post-incident lessons-learned

Within 30 days of incident closure: written lessons-learned, playbook updates, regulator-relationship handover notes, re-positioning recommendations.

03 — The first 72 hours

Hour by hour, from first call to filing.

What the response actually looks like, on the clock. The timing is indicative — every incident shifts depending on facts, scope and jurisdiction — but the choreography below is the standard template the response lead works from. Numbered milestones are the gates that have to clear before the next phase begins.

H+0Activation

Hotline call received

Named lead reached within 60 minutes. Initial intake call scheduled. Internal activation cascade triggered.

H+1Assess

Initial assessment

Structured intake. What is known vs assumed. In-scope jurisdictions. Affected data categories.

H+4Severity

Severity rated, forensics in

Severity tier set. Forensics partner activated. Regulator-clock countdown formally tracked from this point.

H+12Scope

Initial scope established

First-pass affected-individual count. Data categories confirmed. Notification draft begun.

H+24Brief

Stakeholder briefing

Board, exec, legal, comms briefed against draft regulator notification. Customer comms held; preparing.

H+48Refine

Notification refined

Forensics findings integrated. Multi-jurisdiction divergence resolved. Individual notification scoping locked.

H+72File

Regulator notification filed

Submitted to all in-scope regulators, on or before clock expiry. Individual notifications go out per the agreed channel.

The 72-hour window is the maximum, not the target. Where facts permit and jurisdictions align, we file earlier — there is no benefit to running the clock down. Where the facts genuinely cannot be established within 72 hours, we file an initial notification with the available information and a documented timeline for follow-up filings. Both approaches are explicitly contemplated under GDPR Art. 33 and equivalent provisions in PDPL and DPDP guidance.

04 — Three tiers

Standby, active, embedded.

The right tier depends on your risk surface, the maturity of your in-house security and privacy operations, and how willing you are to face an incident with a runbook written in real time. Pre-positioning costs less than activation; activation costs less than improvisation; improvisation costs more than the regulator's fine.

Tier 01 · Standby

Glass-break retainer

SAR 36 — 48k / year
Activation: SAR 1,800 / hr (no included hours)

Pre-positioning only. Hotline access, named lead, basic playbook tailored to your environment. Activation hours billed in addition at the time of incident.

  • 24/7 hotline access & named lead
  • Tailored playbook (annual refresh)
  • Communications template library
  • Forensics partner pre-vetting
  • 1-hour annual review session
Most common Tier 02 · Active

Active response retainer

SAR 60 — 90k / year
Activation: 20 hours included; SAR 1,650 / hr after

The most common tier. Full pre-positioning plus 20 hours of activation time included annually — typically enough to absorb one incident response or two minor incidents without hourly billing kicking in.

  • Everything in Tier 01
  • 20 activation hours included / year
  • Annual tabletop drill (4 hours)
  • Quarterly horizon refresh of playbook
  • Pre-vetted forensics MSA executed
  • Multi-jurisdiction notification choreography
Tier 03 · Embedded

Embedded readiness

SAR 120 — 180k / year
Activation: 60 hours included; SAR 1,500 / hr after

For multi-jurisdictional groups with a high-risk surface, regulated sector exposure, or recent breach history. Embedded readiness — full drill cycle, regulator-relationship pre-introduction, deep playbook integration with internal SOC and legal.

  • Everything in Tier 02
  • 60 activation hours included / year
  • Two annual tabletop drills (8 hours each)
  • SOC integration & alert-routing review
  • Regulator pre-introduction (where appropriate)
  • Sector-overlay playbooks (financial / health)
  • Active investor / board reporting templates

Activation hours during a live incident are billed in 30-minute increments. Tier-included hours roll over up to 25% if unused. Tier 01 has no included activation hours; the retainer fee covers readiness only. Forensics provider time is billed by the forensics provider directly — not absorbed in our retainer hours.

05 — What triggers a call

Eight common activation events.

Not every security event is a privacy breach. Not every privacy event triggers regulator notification. The retainer covers the events where the privacy clock starts running — and the answer to "is this notifiable?" is itself part of the activation work, not something you have to figure out before calling.

Confirmed personal-data breach

Unauthorised access, disclosure, alteration or loss of personal data — confirmed or strongly suspected.

Activate immediately

Ransomware with PII exposure

Ransomware event where personal data is in scope of the encrypted or exfiltrated systems.

Activate within 4 hours

Insider exfiltration

Internal actor — current or former — has exfiltrated personal data outside the controller perimeter.

Activate immediately

Lost / stolen device

Laptop, phone, hard drive lost or stolen with personal data in scope. Encryption-state assessment is the first question.

Activate within 12 hours

Vendor / sub-processor breach

Upstream vendor reports a breach. Your controller obligations to your data subjects are still triggered.

Activate within 4 hours

Regulator letter received

Inquiry, complaint or formal proceedings letter from a privacy regulator. Response timing is regulator-set.

Activate immediately

DSR deluge

Sudden surge in Data Subject Requests (often following bad press, breach disclosure, or activist campaign). SLA risk.

Activate within 24 hours

Unsure — call us first

If you are not sure whether something is notifiable, that itself is the trigger. The first 30 minutes of analysis is what the retainer is for.

No threshold
06 — Scope boundaries

What the retainer does not cover.

Honest scope boundaries agreed in the engagement letter. The retainer is privacy-incident response, not full-spectrum security operations or primary legal counsel. Here is what sits outside the line.

N — 01

Cybersecurity SOC operations

We do not run your Security Operations Centre. Detection, monitoring, alert triage and threat hunting are your SOC's job (or your MSSP's). The retainer activates from a confirmed or suspected privacy event, not from a generic security alert.

N — 02

Forensics provider

We coordinate forensics; we do not perform digital forensics. A pre-vetted forensics partner is engaged at activation (or your nominated firm). Their fees are billed by them directly — never absorbed into our retainer hours.

N — 03

Primary legal counsel

We provide privacy-domain advisory and regulator-facing drafting. Legal opinion as primary counsel — including litigation strategy, regulatory defence positioning and insurance-coverage advice — sits with your in-house or external lawyers.

N — 04

PR / external comms execution

We draft and review communications. Execution — media outreach, statement distribution, social-media response — sits with your PR firm or in-house comms function. We coordinate with them; we do not replace them.

N — 05

Unlimited activation

Each tier has a defined activation-hour bucket. Beyond the bucket, hours are billed at the tier's hourly rate. There is no scenario in which we walk away mid-incident over hours; there is also no scenario in which "unlimited" is the actual deal.

N — 06

Insurance claims management

Where you carry cyber / privacy insurance, we work with your broker and panel counsel under their direction — but we do not manage the claim, certify damages, or substitute for the insurer's appointed advisors.

07 — Common questions

Things people ask before signing.

Common questions about how the retainer activates, what counts as a trigger, and what happens if it never gets used. If yours is not here, the intake form below is the right place — a senior member of the practice will respond within one working day.

What actually activates the retainer?
A call to the 24/7 hotline by a named contact on your engagement letter, confirming an active or suspected privacy incident. The threshold is deliberately low — "we think this might be a breach" is a valid trigger. Triage is part of the activation work; you do not have to be sure something is notifiable before calling. Hours start from the moment the lead picks up.
Can we test the retainer with a drill?
Yes — and we strongly recommend it. Tier 02 includes an annual tabletop drill (4 hours); Tier 03 includes two (8 hours each). Drills run a realistic scenario, exercise your decision tree, surface gaps in the playbook, and rebuild muscle memory in your team. The point is not to pass — it is to find what doesn't work in the calm, not in the panic.
What if it's unclear whether the event is even a breach?
That is the most common activation pattern. Many incidents start as "we noticed something odd" rather than "we have confirmed a breach." The first 30 — 90 minutes of activation work is spent answering the threshold question — is this notifiable, in which jurisdictions, against which clock. If the answer comes back "no breach," activation closes with a written note and minimal hours consumed.
How does multi-jurisdiction notification actually work?
Each in-scope jurisdiction is treated independently for its own clock and threshold, then choreographed for consistency. A typical multi-jurisdiction filing might involve SDAIA (KSA), DPDP Board (India), UAE Data Office and a UK ICO submission — different portals, different language, different threshold tests, but consistent factual narrative. We draft each notification against the regulator-specific template and submit on the right clock.
What if our existing legal counsel wants to lead the response?
That is a common and welcome arrangement. The retainer can run under attorney-client privilege when your counsel is engaged at activation — we work as their privacy-domain advisor, with the legal-strategy decisions remaining with them. The engagement letter contemplates this model; activation just routes through your counsel's instructions rather than directly to your operational team.
Can we have multiple incidents in the same year?
Yes — the retainer covers as many activations as occur in the year. Activation hours draw from the included pool first; once exhausted, hours bill at the tier's hourly rate. There is no per-incident limit. Where a year has been particularly active, the post-year review usually leads to a tier step-up — that is the right response, not absorbing extreme hour overruns at the existing tier.
What happens if we never have an incident?
The retainer fee paid for readiness — that is the deliverable, regardless of activation. The pre-positioning work, drills, playbook refreshes and forensics MSA execution all happen whether or not an incident occurs. Some clients renew for five consecutive years without a single notifiable activation. The argument for the retainer is the same in year five as in year one: the cost of having it is materially smaller than the cost of trying to assemble it during an incident.
How does this fit alongside DPOaaS or an Advisory Retainer?
It complements both. DPOaaS handles the standing privacy function — operations, oversight, board reporting. An Advisory Retainer handles ongoing senior advisory for an in-house DPO. The Breach Response Retainer is specifically the incident-readiness layer. Many clients on Tier 02 or 03 of DPOaaS also carry a Breach Response Retainer at Tier 01 or 02, and the engagement letter cross-references the two so activation handoff is seamless.
08 — Pre-position

Get the playbook written before you need it.

A senior member of the practice will respond within one working day with a proposed scoping call. Submissions go to a practitioner — never a sales desk. If you are in an active incident now, do not use this form — call your existing breach response contacts. If you do not have any, contact us directly.

Senior practitioner response within 1 working day · Submissions are not passed to a sales desk

The right time to position is not after the breach.

A 30-minute scoping call costs nothing. We will tell you honestly which tier is the right fit, whether your existing arrangements have material gaps, and what an annual exercise would look like — pre-positioning is a disciplined exercise, and we'd rather you have it done well than have it done quickly.

Schedule a call