A data incident requires coordinated legal and technical assessment. The affected systems, data, recipients and risks may initially be unclear. We help establish responsibilities, assess notification and information duties, and document decisions as reliable information develops.
What we assess
Possible reporting deadlines should not be considered only after a complete technical investigation. At the same time, communications must distinguish established facts from assumptions. Supplier contracts, actual data flows and the roles of the parties inform the response and any later claims.
Four practical examples
Illustrative scenarios, not accounts of client matters. The appropriate response depends on the documents, applicable law and procedural position.
Ransomware affects the network
Several systems are encrypted and data extraction is uncertain. Legal assessment is updated as technical facts emerge. Potential notification deadlines need attention before every aspect of the cause has been established.
An email reaches the wrong person
Sensitive customer information is sent accidentally. Scope, sensitivity and potential consequences are assessed. Recall or a deletion request may help but does not replace a documented assessment of reporting and information duties.
A provider reports a vulnerability
A cloud provider gives only general information about an attack. We seek the details needed for the customer's own risk assessment. Contractual duties and actual data flows help allocate responsibilities and next steps.
A customer requests information
Following an incident, a person asks which data was affected. Identity checks, response scope and deadlines are organised. The answer should reflect known facts and avoid unsupported reassurance or unverified claims of data extraction.
Documents that help
Incident timelines, technical findings, data categories, processing agreements, supplier notices, containment records and previous communications.
From assessment to the next step
We first distinguish established facts from disputed allegations and identify any step needed to preserve rights. The legal route is then assessed against the commercial objective, available evidence and potential cost. Where technical or foreign-law input is required, responsibilities are coordinated before further work is commissioned. Negotiation, formal proceedings and practical implementation are considered together; a favourable legal position still needs a workable route to the intended result.
Explore all practice areas · Process and fees
Discuss your matter
Tell us the parties involved, your objective and any deadlines. Our main office is in Hanover, Lower Saxony. We advise on German-law matters nationwide and coordinate cross-border work with locally qualified counsel where required.
Send an enquiry — all fields optional · +49 511 3573560
We check conflicts and agree the scope and fees before accepting instructions. An enquiry alone does not create an engagement or preserve a deadline.