Data Breach Response Plan: Scope, Preserve, Assess Harm and Notify on Time

A data breach response comes down to four jobs, in this order: preserve the evidence, scope what was taken, assess the harm, and notify on time. The single most important record is when you became aware of a likely personal-data breach, because several legal clocks start there, not when the forensic report lands. This guide is the data breach playbook in the master plan and playbooks structure; the incident response hub has the rest. It is practical guidance, not legal advice. Notification decisions belong to counsel.

What should happen in the first 24 hours of a data breach?

1. Declare under the master plan, name an incident commander and bring legal in now, so the investigation can be run under privilege where that applies.
2. Stop the ongoing loss: revoke the access path (key, account, public link), but do not delete the data store.
3. Preserve evidence: access logs, database query logs, storage access logs, cloud audit trails, and a snapshot of the affected system.
4. Record the awareness time in the incident log, with who decided and on what evidence.
5. Tell the insurer. Many policies require notice “as soon as practicable” and late notice can put cover at risk.
6. Start scoping: which systems, which files or tables, which fields, which people.
7. Build the clocks table with counsel (below).

The Data Breach Response Checklist has each step with owners and sample answers.

When does the notification clock start?

Each regime has its own trigger, and they are not the same:

Financial entities in the EU also have DORA’s incident reporting deadlines, and many sectors have their own regulators. The Breach Notification Clock Calculator lays out every deadline from your awareness time, and the breach notification guide covers what each notice must contain.

Two mistakes cost the most time. The first is waiting for certainty: GDPR expects notice on a reasonable degree of certainty, with details to follow. The second is dating every clock from the first alert: the SEC clock, for example, runs from the materiality determination, not from discovery.

How do you work out how many people were affected?

Count people, not rows. Exports, backups and nightly snapshots repeat the same customers many times. A breach of three years of nightly exports can contain hundreds of millions of rows and only a few hundred thousand people.

1. List exactly which files, tables or objects were accessed, from logs, not assumptions.
2. De-duplicate on a stable identifier (customer ID, email address).
3. Map each person to a jurisdiction, usually by address, because that decides which laws apply.
4. Record which data fields were exposed for each group. Date of birth plus address carries a different harm from email address alone.
5. Document the method, so the number can be defended and re-run if new evidence appears.

The Breach Records Scoping Estimator takes row counts, snapshot frequency and overlap and gives you a defensible range of unique people by jurisdiction.

Should you delete the exposed data?

Not during the investigation. The data has already been taken; deleting the store only removes your ability to prove what was taken and can look like destroying evidence. Lock it down: remove public access, revoke the keys that reached it, and restrict who can read it. Decide retention afterwards. Often the real lesson is that the data should never have been kept that long.

How do you assess the harm?

Notification to individuals usually depends on the likely harm. Ask:

• What kind of data? Financial, health, government identifiers, credentials and children’s data carry higher harm.
• Was it protected? Strong encryption with keys that were not taken can lower the risk.
• Who has it? A criminal group that is extorting you is a different risk from an accidental email to the wrong customer.
• What can be done with it? Names, birthdays and order history make convincing phishing and scam calls even without card numbers.

What should a breach notice say?

Plain words: what happened and when, what data about this person was involved, what you have done, what they should do, and how to contact a real person. Tell them what scams to expect. Use the same facts in every notice, because regulators compare what you told them with what you told customers and investors. Avoid “highly sophisticated attack”; readers and regulators doubt it. The crisis communications lab practises the wording under pressure.

What if the attacker demands a ransom for the data?

Route it to the master plan: legal, the insurer and law enforcement. Do not reply informally. A sample of the stolen data confirms the theft and strengthens your notification duties; paying does not remove them, cannot be verified, and may break sanctions law. The Customer Database Breach Lab and the Cascade Incident Lab both put you through the extortion email and the clocks it collides with.

Checklist: data breach response

• Incident declared; legal engaged; privilege decision made.
• Access path revoked; data store preserved, not deleted.
• Logs and snapshots preserved with chain of custody.
• Awareness time recorded with the evidence behind it.
• Insurer and broker notified.
• Accessed files and tables listed from logs.
• Unique people counted, mapped by jurisdiction and data fields, method documented.
• Clocks table built with counsel, including contracts and sector regulators.
• Harm assessed per group of people.
• Notices drafted in plain language with consistent facts.

Frequently asked questions

How long do you have to report a data breach? It depends on the law. Under GDPR, the supervisory authority must be notified within 72 hours of becoming aware of a personal-data breach, unless it is unlikely to result in a risk to people. Australia’s NDB scheme requires an assessment within 30 days and notification as soon as practicable once there are reasonable grounds to believe an eligible breach occurred. HIPAA requires notice without unreasonable delay and no later than 60 days after discovery. US state laws vary, commonly 30 to 60 days. Check your specific obligations with counsel.

When does the GDPR 72-hour clock start? When the controller becomes aware of a personal-data breach, meaning it has a reasonable degree of certainty that a security incident has led to personal data being compromised. It does not wait for a final forensic report. Information can be provided in phases if it is not all available within 72 hours.

Does a US company have to disclose a data breach to the SEC? A company with securities registered with the SEC must disclose a cybersecurity incident it determines to be material on Form 8-K Item 1.05 within four business days of that determination. The materiality determination must be made without unreasonable delay after discovery. Counsel should lead this assessment.

Should we notify everyone if we cannot tell whose data was taken? If you genuinely cannot narrow it down, notifying everyone who could have been affected is often the defensible choice. But try to scope first: access logs usually show which files or tables were read. Notices to people whose data was not taken create cost, confusion and complaints.

If we pay the ransom, do we still have to notify? Yes. Paying does not undo the fact that personal data was accessed or taken, so notification duties still apply. There is also no way to verify that the attacker deleted anything, and a payment may break sanctions law depending on who receives it.