阅读中文版本

Breach Notification Workflow

Assemble facts, assess regulatory obligations, and notify affected parties within required timelines.

Overview

Meet legal notification obligations after a confirmed security breach.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• A legal and privacy contact
• Forensic findings
• Notification templates

Procedure

1. Confirm the breach facts

Establish what data was involved, whose data, and the timeframe.

Expected state: A factual scope of the breach exists.

2. Assess notification obligations

With legal counsel, determine which regulations apply and the deadlines.

Expected state: Applicable duties and deadlines are known.

3. Notify regulators and individuals

Send required notices within the deadlines with accurate impact information.

Expected state: Notices go out on time and accurately.

4. Track and document

Keep records of notices sent and any follow-up obligations.

Expected state: The response is fully documented.

# track notification deadlines per obligation
python deadlines.py --jurisdictions eu,us-ca --detected 2026-10-01

Verification

Confirm notices were sent within deadlines, included required content, and are documented for regulators.

Decision points

Notify before facts are fully known?

• Notify within deadline with known facts
• Wait for complete certainty

Recommendation: Notify within the deadline using known facts; deadlines often precede full certainty.

Who approves the notice?

• Legal and privacy
• Engineering alone

Recommendation: Legal and privacy approve the wording to avoid compliance errors.

Common failures

• Missing a statutory deadline carries legal risk.
• Inaccurate notices damage trust.
• No records hinder regulatory review.