What Should a Company Do in the First 24 Hours After a Data Breach?
The first 24 hours after discovering a breach set the tone for everything that follows — here's the practical, hour-by-hour playbook.
💡 In Simple Terms (For Beginners)
The first day after discovering a breach is about containing the damage, preserving evidence, and starting the legal notification clock — not fixing everything perfectly. Speed and clear roles matter more than a flawless response.
- Containment (isolating affected systems) is the first priority, ahead of full investigation.
- Evidence preservation and the DPDP Act's notification clock both start immediately, not after containment is complete.
- Having pre-agreed roles is what actually makes the first 24 hours function under real pressure.
CYBERSECURITY TIPS · October 23, 2026 · 7 min read · By Hardik Patel
What should a company do in the first 24 hours after a data breach? Contain the affected systems immediately, preserve evidence before anything is altered or deleted, and begin the DPDP Act's "without delay" notification process in parallel — not sequentially, since these three things need to happen at roughly the same time, not one after another.
Hour One: Containment Over Investigation
Isolating affected systems from the network — disconnecting rather than powering off, to preserve forensic evidence — takes priority over fully understanding what happened, because containment limits ongoing damage while investigation can continue in parallel.
This is the exact principle covered in our ransomware prevention checklist: isolation matters more than any single other action in the first hour.
Hours 1-6: Evidence and Escalation
Preserving logs, screenshots, and timestamps of what was observed happens alongside containment, not after it — evidence that isn't captured early is often lost once systems are touched further during remediation.
This window also covers internal escalation to whoever is authorised to declare an incident a reportable breach — a decision that shouldn't be ambiguous or improvised, as covered in our incident response plan guide.
Hours 6-24: Notification and Communication
The DPDP Act's "without delay" notification to affected individuals and the Data Protection Board should go out with whatever information is confirmed so far, framed honestly as an initial notice — not held back until the investigation is fully complete.
A pre-drafted notification template, prepared before any incident occurs, removes the delay of writing one from scratch during an active, high-pressure situation.
Key Takeaways
- Containment takes priority over full investigation in the first hour.
- Evidence preservation happens alongside containment, not after.
- DPDP notification starts with an honest "here's what we know so far," not a completed investigation.
- Pre-agreed roles and templates are what make the first 24 hours actually functional under pressure.
Frequently Asked Questions
Q: Should we wait until we fully understand the breach before notifying anyone?
A: No — the DPDP Act's "without delay" standard means notification should happen with available information, not after a complete investigation, which is exactly why a pre-drafted template matters.
Q: What's the single biggest mistake companies make in the first 24 hours?
A: Spending the entire window on investigation before taking any containment action — by the time the full picture is understood, the damage has often continued to spread unnecessarily.
How iTechFixr Can Help
We help businesses build and tabletop-test an incident response plan that actually holds up during a real first-24-hours scenario, not just a document that reads well on paper.
Not sure where you stand? Check your DPDP readiness free (2 minutes).
Need Help With This?
Talk to Hardik directly about your organisation's cybersecurity needs — get a tailored response within 24 hours.
