Data Breach Response Checklist Template

Owned by the DPO or privacy lead. Each yes/no answer in this phase switches on the matching notification tasks later.

• Record the date and time the organisation became aware of the breach — GDPR and most US laws run from awareness or discovery, not from the end of the investigation
• Link this record to the technical incident record — one timeline, one incident reference, and a named contact on each side
• Describe what happened in plain terms — unauthorised access, theft, accidental disclosure, loss of a device or loss of availability
• List the categories of personal data and people involved — customers, staff, patients; names, contact details, government IDs, financial, health or card data
• Record where the affected people live and the role you played — EU/EEA, UK, which US states, other countries; controller, processor or both
• Record whether the data includes health information, payment card data or customer financial information — yes, no or not yet known for each

Assigned to general counsel. Task 2 needs approval from counsel before any outside firm starts work.

• Bring in legal counsel and decide whether outside breach counsel is needed — many cyber policies require use of the insurer’s panel firms
• Have counsel engage the forensic firm where privilege is wanted — with a separate scope from routine security work and a restricted distribution list
• Notify the cyber insurer within the policy’s notice period — record the claim reference and any consent needed before costs are incurred
• Set a holding statement and a single spokesperson — staff are told not to discuss the breach outside the response team
• Place a legal hold on relevant records — logs, emails and documents the investigation or later litigation may need

The decision in task 5 needs approval from the DPO. A yes switches on Phase 6.

• Confirm what the attacker accessed or took — from forensic findings, not assumptions; update this task as the evidence changes
• Assess the likely consequences for the people affected — identity theft, fraud, discrimination, distress, physical harm or loss of confidentiality
• Check mitigating factors — strong encryption with the key not compromised, data recovered, recipient trusted and confirmed deleted
• For health data under HIPAA, complete the four-factor risk assessment — nature of the data, who obtained it, whether it was actually viewed and how far the risk was mitigated
• Rate the risk to individuals and decide whether they must be told — high risk under GDPR or UK GDPR, or a US state or HIPAA trigger; record yes or no with the reasoning

Assigned to the DPO and counsel. Tasks 1 to 3 appear only when Phase 1 records EU or UK residents, US residents or health data. Remove tasks 4 and 5 from your copy if you are not an SEC registrant, a financial institution or an NIS2 or DORA entity.

• Notify the lead supervisory authority or the ICO where required — without undue delay and, where feasible, within 72 hours of awareness; send what you know and follow up in phases
• Notify US state attorneys general and other state regulators where thresholds are met — check each affected state’s deadline, content rules and resident count
• Report to HHS under the HIPAA Breach Notification Rule — within 60 days of discovery for 500 or more people; smaller breaches go in the annual log
• Decide on SEC disclosure and Regulation S-P notices with counsel — Form 8-K within four business days of a materiality decision; individual notices under Reg S-P within 30 days
• File sector reports that apply — NIS2 early warning, DORA major ICT incident reports, the FTC Safeguards Rule notice for non-bank financial institutions
• Record every decision not to notify, with the reasons and who made it — regulators ask for these as often as for the notices themselves

The card brand task appears only when Phase 1 records payment card data. The controller task appears only when Phase 1 records that you acted as a processor.

• If you are a processor, notify each affected controller without undue delay — the controller owns the regulator decision, so give them facts early
• Report suspected payment card compromise to your acquirer and the card brands — Visa requires notice within three calendar days of reasonable suspicion
• Check customer and supplier contracts for breach notice clauses — some set deadlines of 24 to 72 hours and specify the content
• Tell law enforcement where the breach involves crime — and record any request to delay notification, which several laws allow; tell partners whose shared credentials or data feeds were affected

Appears only when Phase 3 records that individuals must be told. Letters need approval from counsel before they are sent.

• Draft the notice in plain language — what happened, what data, what you are doing, what they should do and who to contact; check each law’s required content
• Confirm the mailing list and contact method — current addresses, email where permitted, and substitute notice where contact details are missing
• Arrange credit monitoring or identity protection where required or offered — Connecticut, for example, requires at least 24 months where Social Security numbers were breached
• Set up a call centre or helpline with a script and escalation path — staffed before the letters land, with a log of complaints and questions
• Send the notices and record the date, method and number sent — keep a copy of each version and the list it went to
• Publish a website notice or media statement where the law requires it — HIPAA requires media notice for 500 or more residents of a state or jurisdiction

Closure needs approval from the DPO and general counsel.

• Complete the breach register entry — facts, effects and remedial action, as GDPR Article 33(5) requires for every breach, reported or not
• Answer regulator follow-up questions and record each exchange — correspondence, deadlines and any undertakings given
• Hold a lessons-learned review with legal, security and communications — what slowed the decisions, where the facts were wrong, what the letters missed
• Raise improvement actions with owners and dates — data minimisation, encryption, retention, processor contracts and the breach procedure itself
• Approve closure — confirming every notice is sent, every decision is recorded and evidence is retained for the required period