All tabletop exercises
Data breach·Intermediate·Mixed audience
Five notification clocks start at once
The prompt — read this to the room
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.
Total duration
2 h
People to involve
6
Best fit
Education, Saas
Who to involve
Most important first.
- Privacy officer / DPO
- Legal counsel
- CISO / Head of security
- Communications / PR
- Customer support
- Cloud engineer
What it tests
- Build a notification matrix covering regulators, controllers and individuals, with deadlines and owners
- Distinguish where the company is controller and where it is processor, and what changes as a result
- Produce consistent core facts that every notice draws from
- Prepare support and communications for the volume that notification will create
Outline of activities
- 1Scoping: what was exposed, to whom, for how long, and was it accessed
- 2Mapping the clocks: who must be told, by when, under which law
- 3Controller or processor: the university customers
- 4One set of facts, many notices
- 5Launch day: support, communications and regulator follow-up
- 6Debrief: a reusable notification matrix
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…