A payroll file has gone to the wrong address. A supplier reports unauthorised access to a customer platform. An employee cannot open the only current copy of a client register. These events require a decision process that connects technical facts with legal duties. Waiting for a perfect forensic report can leave the organisation unable to explain when it knew, what it did and why.
This analysis focuses on the response file: how an Albanian business should organise evidence, assess notification and reach a defensible decision. It complements the broader privacy overview and supplier-contract guidance. The practical recommendations below are working methods, not a statutory incident timetable or a promise that following a checklist prevents liability.
1. Identify the event and the organisation’s role
The domestic starting point is Law No. 124/2024, especially Articles 5, 28–29 and 101. Its breach definition reaches accidental events as well as unlawful interference. The controller and processor have different functions. Identify whose processing is affected before deciding who should communicate with whom.
In practical terms, open one incident record with a named coordinator. Record the source of the alert, the system, the information believed affected and the facts still uncertain. Keep suspicion separate from confirmation. A note saying “possible export of customer records” is more useful than an unsupported statement that every customer has suffered identity theft.
Check whether the company determines the processing or acts for a client. A service provider may be a processor for one dataset and a controller for its own employment records. The commercial description “technology partner” does not answer this question. Use the contract and actual responsibilities to prepare a map of the people who need information.
2. Contain the incident while preserving useful evidence
Technical containment and legal assessment should proceed together. Depending on the event, specialists may recommend restricting an account, revoking a sharing link or isolating an affected device. The appropriate step depends on the system; this article is not an instruction to erase or rebuild equipment. A hurried repair can remove the evidence needed to understand what happened.
Ask the technical team to explain what a proposed action will preserve and what it may overwrite. Keep original alerts, relevant logs, supplier messages and a record of changes, with controlled access. Avoid circulating complete identity documents or payroll files merely to demonstrate the problem. Evidence collection should not create a second disclosure.
Choose a communication channel that remains usable if the normal platform is compromised. Assign a substitute for the coordinator. These are practical continuity measures, not a requirement to adopt a particular product. Their purpose is to prevent an incident from becoming several unconnected investigations with inconsistent instructions.
3. Record awareness and assess notification promptly
Article 29 requires the controller to notify the Commissioner as soon as possible and within 72 hours of awareness, unless the breach is unlikely to risk individuals’ rights and freedoms; reasons must accompany delay. The processor must inform the controller immediately after awareness. Documenting every breach, including effects and corrective measures, is separately required.
For GDPR cases, the EDPB’s Guidelines 9/2022 discuss awareness as a reasonable degree of certainty that an incident has compromised personal data. They distinguish prompt initial investigation from waiting for a complete forensic conclusion. This is EU interpretative guidance, not a binding Albanian decision defining every borderline case.
The response file should therefore identify several moments rather than invent one convenient start time: the first alert, the first technical check, the facts supporting awareness and each escalation. If a supplier sends an incomplete message, ask focused questions immediately. Do not treat an internal approval meeting as necessarily creating the first moment of awareness.
4. Assess harm to people, rather than only loss to the business
A commercially small incident can matter greatly to the person affected. Ask what the information reveals, who received it, whether it can be linked to a person and how it could be misused. Consider whether the event involves confidentiality, alteration or loss of availability. A restored service does not, by itself, answer whether information was exposed.
Build the assessment around evidence. “The recipient said the file was deleted” is one fact to test, not a complete risk conclusion. Was it opened, copied or forwarded? Was access technically restricted? Is there a credible record of deletion? Identify the evidence available and the uncertainty that remains, without pretending that uncertainty proves either safety or serious harm.
Compare options expressly. Continuing a limited investigation may clarify a genuinely uncertain event; waiting solely for managerial comfort can leave the company with no sound explanation for delay. Conversely, a vague notification describing an unverified catastrophe may be inaccurate. The objective is timely, factual communication with clear boundaries around what is known.
5. Separate Commissioner notification from communication to individuals
There is an important transitional issue on 9 November 2026. Article 101(2) delays Article 29(3), concerning communication to affected individuals, until two years after publication. The delayed paragraph must not be described as already generally effective. This does not remove the need to examine other applicable duties, Article 29(7), contractual commitments or a separate GDPR assessment.
The decision record should distinguish the recipient and legal basis for each communication. A message to the Commissioner, a notice to a client controller, an insurer notification and information to an affected employee may serve different purposes. Sending one does not automatically satisfy the others. Check the current official submission channel when an actual notification is required; do not assume a historical email address remains correct.
Prepare a concise factual account: the event, affected information, contact person, likely consequences and measures taken or proposed. State estimates as estimates. If details change, preserve the earlier version and explain the update. The file should show what the organisation reasonably understood at the time, rather than silently replacing its history.
6. Two hypothetical cases and the choices they expose
Hypothetical case one: an employee sends a spreadsheet containing names and salary figures to an external supplier by mistake. The recipient replies that it was not opened. The company should secure the message trail and investigate the scope before concluding that risk is negligible. The sensitivity of employment information and the recipient’s ability to link it to people matter more than the attachment’s small size.
A proportionate practical response could include a focused deletion request, technical confirmation where available, review of forwarding and a documented notification assessment. Training may be appropriate afterwards, but training alone does not address the disclosure already made. If the investigation establishes further recipients, the assessment needs reopening.
Hypothetical case two: a supplier reports that an unauthorised account downloaded records, but cannot yet identify all affected customers. The client should not wait passively for a final spreadsheet. It should establish its own role, seek logs and a credible scope estimate, and consider the notification decision on the facts available. The EDPB guidance explains phased notification for GDPR; that guidance should not be copied as an unexamined procedural promise under Albanian law.
The supplier and client may disagree about responsibility. Preserve that dispute for the contractual assessment while continuing necessary cooperation. A demand for an admission of liability can distract from the urgent factual questions. The immediate priority is to understand and reduce exposure; allocation of costs requires its own evidence.
7. Close with corrective actions and a test
A useful closure record identifies the cause supported by evidence, the limits of the investigation, the decision on each notification and the remaining work. Assign each corrective action to a person and specify how completion will be checked. Replacing a password is different from verifying that excessive access rights have been removed across the system.
Compare a narrow fix with a broader process change. Restricting one sharing link may stop the present disclosure; changing approval and access practices may address recurrence. The broader measure costs time and needs an owner, while the narrow fix may leave the same weakness elsewhere. The record should explain the chosen balance.
Alba Legal can assist with legal assessment, contractual cooperation and communication, alongside technical specialists. The data privacy and cybersecurity service provides the relevant starting point. Sources were checked on 9 November 2026. This is general information; a live incident requires review of its facts, applicable regimes and current reporting requirements.
