---
title: "Plan for a data breach · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/privacy/breach-plan
updated: 2026-10-20
licence: "All rights reserved"
---

# Plan for a data breach

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Privacy](https://agentwranglers.se/playbook/website/privacy)
- Rule: Write down what to do when personal data leaks, before it happens.
- How: Name who decides, how to stop the leak, and how to tell people. Under GDPR, report a breach to the supervisory authority within 72 hours. Tell the people affected when the risk to them is high. Keep a log of every breach, even small ones. For keeping evidence and handling the attack itself, see [security incidents](https://agentwranglers.se/playbook/operations/incidents/security-incidents). See also [start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks) and [log every breach with its decision](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-register).
- Check: Once a year, run a practice breach with the plan. The team reaches the 72-hour report step on time.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy/breach-plan`.

- Previous: [Sign a contract with every processor](https://agentwranglers.se/playbook/website/privacy/processor-agreements)
- Next: [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests)
- [Privacy](https://agentwranglers.se/playbook/website/privacy)