Breach Governance

Structured incident response for breach detection, assessment and timely notification to the Board and affected data principals.

The Clock Starts at Detection

Breach obligations are time-bound. A defined process beats a war room trying to remember who needs to be told and by when.

Capture suspected breaches from security tools, staff reports and vendor disclosures into one register.

Score impact using the data categories, volume and likelihood of harm to the data principals affected.

Start the statutory timer at detection and track every deadline for Board and user notification.

Identify which data principals and purposes are involved by linking to the consent and data registry.

Run containment, investigation and communication steps as assigned tasks, not improvised calls.

File the timeline, decisions and corrective actions as evidence of a reasonable response.

The incident is registered with its source and detection time, which starts the notification clock.

Scope the data, purposes and people affected, then score severity to decide the response path.

Issue Board and data principal notifications within the deadline, then record remediation and lessons.

Put detection, assessment and notification on rails so a breach does not become a second compliance failure.