Plan for a data breach

How to do it

Name who decides, how to stop the leak, and how to tell people. Under GDPR, report a breach to the supervisory authority within 72 hours. Tell the people affected when the risk to them is high. Keep a log of every breach, even small ones. For keeping evidence and handling the attack itself, see security incidents. See also start every reporting clock from one moment and log every breach with its decision.

How to check

Once a year, run a practice breach with the plan. The team reaches the 72-hour report step on time.