Data Breach Response Plan

DATA BREACH RESPONSE PLAN

Organisation: Organisation name​

This plan implements the PDPA Data Breach Notification Obligation, in force since February 2021: the organisation must assess a suspected breach (PDPC guidance: aim to conclude the assessment within around 30 days), and if the breach is notifiable — because it results in, or is likely to result in, significant harm to affected individuals, or affects 500 or more individuals — notify the Personal Data Protection Commission (PDPC) as soon as practicable and in any case no later than 3 calendar days after determining the breach is notifiable, and notify affected individuals as soon as practicable.

1. INCIDENT 1.1. Incident date and description​

2. DATA AND INDIVIDUALS AFFECTED 2.1. Data types involved and estimated number of individuals affected​

3. NOTIFIABILITY ASSESSMENT 3.1. Notifiability assessmentNotifiable — significant harm to affected individuals likelyNotifiable — 500 or more individuals affectedNot notifiable — assessed as low risk

4. CONTAINMENT 4.1. Containment actions taken​

5. NOTIFICATION 5.1. PDPC notified on: Date PDPC was notified 5.2. Affected individuals notified on: Date affected individuals were notified 5.3. Exceptions applied (if not notifiable): Exceptions applied (if not notifiable)​

6. CORRECTIVE MEASURES 6.1. Corrective and preventive measures​

7. RESPONSIBILITY AND LOGGING 7.1. Responsible DPO: Responsible DPO​ 7.2. Logged at: Reference to the incident log​