Rehearsing the Deadline: A 48-Hour Notification Drill for UK Compliance Teams

Most UK compliance functions hold a crisis communications plan that has been exercised at least once. Far fewer have exercised the statutory notification itself: the judgement that an incident is notifiable, the identification of every regime that bites, the drafting of the first filing, and the assembly of evidence that may be read months later by a supervisor or an enforcement lawyer. The two activities fail in different ways. A poorly worded press statement can be corrected. A missed or late notification usually cannot.

Why the notification clock behaves differently

Notification duties are deliberately unforgiving. The Information Commissioner's Office expects personal data breaches to be reported within 72 hours of awareness under the UK GDPR and the Data Protection Act 2018, with information permitted to follow in phases. Operational incidents at PRA- and FCA-regulated firms trigger a far shorter expectation, measured in hours, where an impact tolerance has been or may be breached. Sector regimes add their own layers: the NIS Regulations, the requirements of health and education regulators, and the reporting expectations that apply to certain financial crime events.

Two features of these regimes create the real difficulty. First, the clock generally starts at awareness, not at confirmation. A team that spends a day establishing the cause before considering whether the incident is notifiable has already lost time it will need later. Second, notifiability is rarely a single decision. It is a series of them, taken under uncertainty, by people who may not be in the same room.

That is what the drill described below is designed to expose.

Three design rules

• Start cold. Brief the scenario to the facilitator only. The incident controller and decision-makers should receive the same fragmentary, partially conflicting information a real event supplies.
• Inject friction. Withhold a fact, remove an approver, make one system log unavailable, and introduce a plausible but wrong early theory.
• Measure latency, not prose. The output of interest is how long it takes to reach a defensible decision and a filed notification, not how polished the narrative reads.

T+0 to T+6: detection and triage

The drill begins with an alert that could plausibly be several things: a ransomware precursor, a misconfigured storage bucket, a payment fraud indicator, or an insider event. The first test is whether the organisation can record the moment of awareness in a way that would stand up to later scrutiny, because that timestamp anchors every subsequent deadline.

Triage should be run against a pre-built matrix rather than from memory. A useful matrix maps four variables to the regimes they engage: the category and volume of data affected; the number and type of customers or counterparties; the business services disrupted and their impact tolerances; and any third-party or supply chain dimension. The matrix should name, for each combination, the regulator, the deadline, the approver and the evidence the regulator will expect.

The output of this phase is a single notification triage record, timestamped, naming the regimes considered and the reasons for inclusion or exclusion. Reasons for exclusion matter as much as reasons for notification; they are the first thing an investigator will ask about.

A common failure surfaces here: the data protection officer and the security lead reach different conclusions because they are answering different questions. "Is this an operational incident?" and "is this a personal data breach?" are not the same test, and an incident can be both, or neither. The drill should require both answers to be recorded independently before they are reconciled.

T+6 to T+24: decision rights and the first filing

This is where most drills break down. The scenario should deliberately make the natural approver unavailable, then observe what happens. If the answer is an ad hoc search for someone senior enough, the organisation does not have decision rights; it has a hope.

Before the drill, the following should be documented and tested: who may determine that an incident is notifiable; who signs the submission; who may authorise a delay where a regime permits one, for example at the request of law enforcement; and who speaks to the regulator when the primary contact is unreachable. Accountability under the Senior Managers and Certification Regime should be explicit rather than assumed, with the relevant senior manager identified by function.

The first filing itself should be drafted from facts known at the time, with a clearly marked section for information not yet available and a date by which it will follow. Regulators generally prefer an early, candid notification with gaps over a complete one that arrives late. The drill should test whether the team can produce that document within the window, using only evidence it actually holds.

T+24 to T+48: the evidence pack and phased updates

By the second day, attention shifts from filing to defensibility. The evidence pack assembled during the drill should include: a timeline with consistent timestamps and a stated time zone; a data map showing what was affected and how that was established; a record of containment actions and who authorised them; the risk assessment that underpinned the notification decision; the decision log; copies of every submission and acknowledgement; and the internal communications that shaped the response.

Two handoffs deserve particular attention. The first is security to compliance: technical findings must arrive in a form that can be filed, which usually means someone has to translate them. The second is compliance to communications: the statement to customers and the statement to the regulator must be consistent, but the communications function should not be editing the filing.

Scoring the exercise

A small set of measures is enough: time from awareness to a recorded triage decision; time from that decision to first filing; completeness of the evidence pack against a checklist; the number of unplanned escalations; and whether each handoff produced a written record. Compare the results against the deadlines in the matrix, not against a general sense of how the day went.

Findings that recur

• The team believes the clock starts when an incident is confirmed rather than when it is suspected.
• The evidence pack is assembled after the filing, not before it.
• One regulator is notified and the others are forgotten, usually the sector regulator or the one with the shortest window.
• The approved submission drifts from the approved facts as it passes through review.

After the drill

Convert the findings into actions with named owners and dates, report them to the relevant board committee, and update the notification matrix and contact schedules. Rotate the scenario each quarter, covering a data breach, an operational outage, a third-party failure and a fraud-related event with reporting consequences. The objective is not a flawless performance. It is a team that knows, before the deadline exists, who decides, who signs and what evidence it will need.