GDPR #infosec question. If, during internal audit you discover a sensitive data folder has weak permissions so any employee could have accessed its contents, would you give the ICO an initial heads up or wait until after full investigation was possible?

Would it change your approach if it was a holiday weekend? If you investigate now it's 3-4x the cost. If you wait it's >72 hours before you even start. Even if you start now, you might not have a good answer in 72 hours.

Just to be clear, this is not a subtweet. It's on the back of an ongoing discussion around policy documents. I'm not hinting there has been a breach!