Datadata-law#40F2FE#0A7C8A

Data Breach Response

The first 72 hours after a breach decide almost everything, and you will face them with lawyers.

We will notify the AEPD and inform those affected where the law requires it.

§ 1

Approach

What a company reports in the 72 hours after a breach is the first thing the AEPD will read, and it should be well written.

We will assess whether to notify

We will analyse which data has been affected and the risk to individuals, and decide with you whether the law requires notification.

We will write what the Agency reads

We will draft the notification to the AEPD and, where the law requires it, the notice to those affected, with the precision of a document that may end up in proceedings.

We will keep a record of everything

We will document the breach in your internal register, because the Agency may ask for it even where no notification was made.

§ 2

Engagement

Companies facing a breach
We will notify the AEPD and inform those affected where the law requires it.
€2,500 + VAT
72 hours

El importe exacto se cierra en la hoja de encargo antes de pagar, con los gastos previsibles incluidos. Si el encargo se alarga, no pagas más.

§ 3

Process

How the engagement unfolds

Initial Consultation

A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.

Breach Assessment

An urgent analysis of the facts, the data affected and the risk to individuals, which determines whether the breach must be notified to the AEPD and communicated to those affected.

AEPD Notification

Drafting and filing of the breach notification to the AEPD within 72 hours and, where the risk is high, of the notice to the individuals affected.

Breach Record

Internal documentation of the breach, its effects and the measures taken, which the company must keep even where no notification to the AEPD was required.

§ 4

Team

Who handles it

Guillermo Passas Varo, founding partner of PASSAS

I see legal practice as a discipline of precision. I work where the law meets technology and cross-border operations, and I read code and contracts with the same attention. Before accepting an engagement I tell you whether it is worth pursuing and what it costs, at a fixed price.

§ 5

Questions

What people ask before instructing this service

Do I have to notify every breach?

Only those that pose a risk to people's rights. If the risk is high, those affected must also be informed. We will assess it with you as soon as we know the facts.

What if the 72 hours have already passed?

Notification is still mandatory and must explain the reason for the delay. The sooner you write to us, the better.

Does it include the defence if proceedings are opened later?

The defence is a separate engagement, AEPD Defence, with its own proposal.

How much does it cost?

From €2,500 + VAT. The time limit is set by law: 72 hours from when you become aware of the breach.

Book your Virtual Consultation with a lawyer. Today.

60 minutes on Google Meet with a qualified lawyer specialising in artificial intelligence, data, litigation or international law. €90 including VAT, deducted from the first invoice if we take on your matter. You leave with legal judgement and a fixed price for whatever comes next.

Choose your lawyer and a time in the calendar. No forms first, no sales calls.