What must be reported after a cybersecurity incident, and when?

In brief

A significant cybersecurity incident must be reported in stages: first within 24 hours, then within 72 hours, and finally within one month. Under the Finnish Cybersecurity Act 124/2025, section 11, the clock starts when the significant incident is detected. The 24-hour report gives an early warning, the 72-hour report gives the first assessment, and the one-month final report explains the incident, likely cause, impact and mitigation. If personal data is involved, the General Data Protection Regulation's Article 33 can add a separate 72-hour duty to notify the data protection supervisory authority.

When is an incident significant?

The reporting duty in the Finnish Cybersecurity Act does not cover every small disturbance. It applies to a significant incident.

Under the Finnish Cybersecurity Act, section 11, an incident is significant when it has caused or may cause serious disruption to services or major financial losses to the organisation. It is also significant when it has affected or may affect other natural or legal persons by causing substantial material or non-material damage.

In work terms, this means the first question is not whether something technical happened. The question is whether the event may seriously affect service delivery, the organisation's finances, or other people or organisations.

Examples of the kind of assessment the organisation needs to make include:

• whether a public or customer-facing service is seriously disrupted;
• whether the organisation may suffer major financial loss;
• whether another person, customer, resident, supplier or organisation may suffer substantial harm;
• whether the incident may cross borders;
• whether the event may have been caused by crime, unlawful action or hostile action.

The NIS2 Directive's Article 23 uses the same basic structure for significant incidents. It requires essential and important entities to notify the competent authority or computer security incident response team of incidents that have a significant impact on service provision.

The 24-hour early warning says that a significant incident has been detected

The first report is an early warning. Under the Finnish Cybersecurity Act, section 11, it must be made within 24 hours of detecting the significant incident.

The purpose is speed. At this stage, the organisation may not know the full cause, scope or final impact. The law therefore asks for the core warning information first.

The 24-hour report must state three things.

• The significant incident has been detected.
• Whether the organisation suspects that the incident was caused by a crime, another unlawful act or a hostile act.
• Whether cross-border effects are possible and likely, and the information used to anticipate those cross-border effects.

The NIS2 Directive's Article 23 describes a similar early warning within 24 hours of becoming aware of the incident. It also focuses on whether unlawful or hostile acts are suspected and whether cross-border effects are possible.

For a decision-maker, the practical point is simple. Incident handling must be able to identify a potentially significant incident fast enough for the first report. A process that waits for a complete forensic investigation may miss the 24-hour stage.

The 72-hour incident notification gives the first assessment of impact

The second report is the follow-up incident notification. Under the Finnish Cybersecurity Act, section 11, it must be made within 72 hours of detecting the significant incident.

This report is more substantial than the first warning. It is still not the final investigation report. It is the organisation's first structured assessment.

The 72-hour report must include:

• an assessment of the nature, severity and effects of the significant incident;
• technical indicators of compromise, if they are available;
• possible updates to the information given in the 24-hour report.

An indicator of compromise is a technical clue that a system may have been affected. A simple everyday example is a burglar leaving a broken lock or a footprint. In cybersecurity, the clue may be a technical sign found during incident handling, if such a sign is available.

The NIS2 Directive's Article 23 also places the incident notification at 72 hours and connects it to the first assessment of severity and impact. It adds that indicators of compromise are included if available.

There is one important exception in the Finnish Cybersecurity Act. A trust service provider must make the follow-up notification within 24 hours, not 72 hours, if the significant incident affects the provision of its trust services.

The one-month report brings together causes, impacts and mitigation

The final report comes after the first two notifications. Under the Finnish Cybersecurity Act, section 13, the final report must be given within one month of submitting the 72-hour follow-up notification.

The final report must include:

• a detailed description of the incident, including its severity and effects;
• an explanation of the type of threat or root cause that probably caused the incident;
• an explanation of completed and ongoing measures to mitigate the effects of the incident;
• an explanation of possible cross-border effects.

Root cause means the underlying reason the incident happened. In everyday terms, it is the difference between saying that water is on the floor and saying that a pipe burst behind the wall. In incident handling, the final report should move from the visible symptoms to the likely underlying cause.

Some incidents do not end neatly within the first month. Under the Finnish Cybersecurity Act, section 12, if a significant incident is long-running, the organisation must provide an interim report no later than one month after the follow-up notification. Under section 13, the final report is then due within one month of the end of handling the incident.

The NIS2 Directive's Article 23 follows the same idea. If the incident is still ongoing when the final report would be due, the entity provides a progress report and then a final report within one month after the incident has been handled.

Deadlines and contents side by side

The deadlines are easiest to manage when the organisation treats them as one reporting chain, not three separate tasks.

Stage	Deadline under the Finnish Cybersecurity Act	Main content
First report	Within 24 hours of detecting the significant incident	Detection of the incident, suspected crime or hostile action, and possible cross-border effects
Follow-up report	Within 72 hours of detecting the significant incident	First assessment of nature, severity and effects, indicators of compromise if available, and updates to the first report
Interim report	On request by the supervisory authority, and for a long-running incident no later than one month after the follow-up report	Situation updates and progress in handling the incident
Final report	Within one month of the follow-up report, or for a long-running incident within one month of the end of handling	Detailed description, severity and effects, likely threat or root cause, mitigation measures and possible cross-border effects

The Finnish Cybersecurity Act, section 11, also states that the supervisory authority may issue more detailed technical rules on the content, technical format and procedure for notifications, communications and reports under sections 11 to 15. This means the legal table is the baseline. The practical submission format may be specified further by the competent supervisory authority in its sector.

A personal data breach can create a second 72-hour notification

A cybersecurity incident and a personal data breach can be the same event, but the reporting duties are not the same.

A cyber incident report under the Finnish Cybersecurity Act concerns a significant incident affecting network and information system security and services. A personal data breach notification under the General Data Protection Regulation concerns personal data.

The General Data Protection Regulation's Article 33 says that, when a personal data breach occurs, the controller must notify the competent supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of it. The exception is when the personal data breach is unlikely to create a risk to the rights and freedoms of natural persons.

That GDPR notification must at least describe the personal data breach, including where possible the groups and estimated numbers of affected data subjects and personal data records. It must give the name and contact details of the data protection officer or another contact point. It must describe likely consequences and the measures proposed or taken, including measures to mitigate possible adverse effects.

The General Data Protection Regulation's Article 33 also says that, if all information cannot be provided at the same time, it may be provided in phases without undue delay. It also requires the controller to document all personal data breaches, including the facts, effects and corrective actions.

The General Data Protection Regulation's Article 34 adds a separate communication duty to the affected person when the personal data breach is likely to create a high risk to the rights and freedoms of natural persons. The message to the person must use clear and plain language.

For staff skills, this is why cyber reporting and data protection training should not be treated as separate islands. A ransomware event, account compromise or system intrusion may need both cyber incident handling and personal data breach assessment. The basic data protection skills are covered further in What data protection skills must every employee have?.

Management is responsible for organising incident handling

Incident reporting is not only an information technology task. It is also a management duty.

The NIS2 Directive's Article 21 requires cybersecurity risk-management measures to include incident handling. The same article also lists risk analysis, security policies, business continuity, supply chain security, vulnerability handling, assessment of measures, basic cyber hygiene and cybersecurity training among the required areas.

The NIS2 Directive's Article 20 places responsibility at management-body level. Management bodies must approve cybersecurity risk-management measures and oversee their implementation. The article also requires management-body members to take training so that they can gain enough knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on services.

For a municipality or company, this means the incident reporting chain needs ownership before an incident occurs. Someone must be able to decide whether the incident is significant. Someone must collect the 24-hour information. Someone must own the 72-hour assessment. Someone must ensure the final report is completed, including likely root cause and mitigation.

Training is part of this control environment. The wider NIS2 and Finnish Cybersecurity Act training duty is discussed in NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene. Staff cyber hygiene is discussed in What does the Cybersecurity Act require from staff cyber hygiene?.

What the obligation does not mean

The reporting duty has limits. These limits matter because they make the process workable.

First, the Finnish Cybersecurity Act's incident notification duty is for significant incidents. It does not say that every minor technical event must be reported as a significant incident. Minor events still may need internal handling, but the statutory 24-hour, 72-hour and one-month chain is tied to the significant-incident threshold.

Second, the first report is not a finished investigation. The 24-hour stage is an early warning. The law asks for detection, suspected criminal or hostile cause, and possible cross-border effects. The more detailed assessment comes later.

Third, the 72-hour report does not require unavailable technical indicators. The Finnish Cybersecurity Act, section 11, requires technical indicators of compromise if they are available. If they are not available at that point, the law does not turn them into a guess.

Fourth, the one-month report does not always end the process if the incident is still long-running. The Finnish Cybersecurity Act, sections 12 and 13, provide for an interim report and a later final report when the handling of the incident ends.

Fifth, a cyber incident report does not replace GDPR duties. If personal data is involved, the General Data Protection Regulation's Articles 33 and 34 must be assessed separately.

Finally, the exact technical format and procedure may be specified further. The Finnish Cybersecurity Act, section 11, allows the supervisory authority to give more detailed technical rules for the content, technical format and procedure of reports. The legal deadlines are clear, but the operational reporting channel may depend on the applicable supervisory authority.