Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.

The first hours

Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents additionally need legal involved early, because the notification clock and legal privilege both start now.

Decide: isolate or observe. Isolating stops further loss and may leave persistence undiscovered elsewhere; observing risks more data leaving. There is no general answer — it is a judgement for the commander with legal and business input, and it should be made explicitly rather than by default.

Preserve evidence before changing anything. Snapshot affected instances, capture memory if practical, and export logs to somewhere the attacker cannot reach. Reimaging a host immediately is the classic error: it stops the incident and destroys the information needed to determine what was accessed.

Contain. Revoke credentials and active sessions, block identified egress destinations, disable compromised accounts, isolate affected workloads at the network layer.

Then scoping, which is the part that matters legally

The questions to answer: what was accessed, whose data, how much, over what period, and did it leave?

That is answerable only from evidence collected before the incident. What it requires:

Audit logs of data access with sufficient retention — retention must exceed dwell time, or the initial access is already deleted.

Attribution to a real principal, which requires identity propagated through service hops and into asynchronous processing. Logs attributing everything to "the API gateway" cannot scope a breach.

Tamper-evidence, or the logs are not reliable evidence of anything.

Egress records — flow logs showing volume and destination — to establish whether data actually left.

Knowing where the data is, which is lineage and classification.

Why scoping determines everything after

If you cannot say which records were accessed, you must assume all of them. That changes the notification population from hundreds to millions, and with it the cost, the regulatory consequence and the reputational damage.

GDPR requires notification within 72 hours of becoming aware. The clock does not wait for scoping to be comfortable.

What a strong answer adds

Stating the design conclusion plainly: breach response capability is an architectural property, set by log retention, identity propagation, audit-log integrity, egress visibility and data lineage. Every one is decided long before an incident, and together they determine whether day one produces an answer or an assumption.