Agent WranglersCMP-71Recommended
Plan for a data breach
Write down what to do when personal data leaks, before it happens.
How to do it
Name who decides, how to stop the leak, and how to tell people. Report a breach to the supervisory authority by the GDPR deadline that start every reporting clock from one moment computes. Tell the people affected when the risk to them is high. Keep a log of every breach, even small ones, as log every breach with its decision says. For keeping evidence and handling the attack itself, see security incidents.
How to check
Once a year, run a practice breach with the plan. The team reaches the authority report step before its computed deadline.
Sources
Related rules
- Keep evidence in security incidents in Operations
- Start every reporting clock from one moment in Compliance
- Log every breach with its decision in Compliance
- Keep the notices ready in Compliance
- Keep the US breach notice laws as data in Compliance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan">Agent Wranglers compliance playbook</a>. In code you write, add a comment next to it with the same link.