Procedure
Data Protection and Privacy Breach Response Procedure
This procedure defines the lifecycle for detecting, containing, assessing, notifying, remediating, and closing personal data breaches and privacy incidents. It establishes mandatory roles, response timeframes, jurisdiction-specific notification obligations, and evidence requirements, and supports meeting regulatory notification deadlines for all applicable laws.
- Type
- Procedure
- Version
- 1.10.14
- Date
- 2026-11-07
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material privacy, regulatory, or AI governance change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose and scope
- 2. Governance
- 3. Breach severity classification
- 4. Detection and initial assessment
- 5. Containment
- 6. Notification assessment
- 7. Notification content requirements
- 8. Post-breach review
- 9. Record keeping
- 10. Privacy breach-response execution checklist
- 11. Metrics
- 12. Framework alignment
Frameworks it maps to
- ISO/IEC 27701:2025 (privacy incident management)
- CSA CCM v4.1 SEF-08, SEF-03
- GDPR Arts. 33 to 34 (Art. 33(1) notification to the supervisory authority; Art. 34(1) communication to the data subject)
- UK GDPR Arts. 33 to 34
- EDPB Guidelines 9/2022 on personal data breach notification (Version 2.0) paragraph 118
- PIPEDA Breach of Security Safeguards Regulations (successor Bill C-36/PPCDA proposed, not in force)
- Quebec Law 25
- Ontario FIPPA s. 40.1 (in force since 2025-07-01)
- Ontario MFIPPA s. 30.1 (not yet in force; comes into force 2027-01-01)
- GC Cyber Security Event Management Plan §2.3.1.4 (held text: date modified 2026-05-20, cited at the edition held, currency to be confirmed upstream)
- PIPL Art. 57
- Cybersecurity Law Art. 44 para. 2 and, where the incident also endangers network security, Art. 27 (amended numbering, in force 1 January 2026)
- DPDPA 2023
- Digital Personal Data Protection Rules 2025
- DPBI
- UU PDP (Law No. 27 of 2022) Art. 46
- LGPD Arts. 48 to 49
- Law No. 6698 (KVKK) Art. 12(5)
- FISMA 2014 (44 U.S.C. 3553 note) for federal agencies
- ISO/IEC 27035-1:2023
- ISO/IEC 27035-2:2023
- ISO/IEC 27035-3:2020
- NIST SP 800-61 Rev. 3, including §2.3 (roles and authorities to confiscate, disconnect or shut down technology assets)
- ISO/IEC 27037:2012 §5.4.1 (minimize handling of the original; document unavoidable changes)
- NIST SP 800-124 Rev. 2 §4.3.3 (remote wipe scope and its limits as a sole control)
- ISO/IEC 27037:2012 §5.4.1
- NIST SP 800-111 §§3.1.1 and 3.2 (pre-boot authentication)
- EDPB Guidelines 9/2022 (Version 2.0) paragraphs 78 to 80 and Annex B example (i)
- GDPR Art. 34(3)(a)
- CSA CCM v4.1 SEF-06
- ISO/IEC 27701:2025 §7.5.3, Annex A.3.14
- ISO/IEC 27701:2025 Annex A.3.12
- BASC International Standard v6
Related documents
- Privacy and Data Governance Policyprivacy
- Bring Your Own Device (BYOD) Policysecurity
- Security Incident Response Proceduresecurity
- Privacy Management Programme Charterprivacy
- Privacy Jurisdiction Indexprivacy
- Data Classification and Handling Standardsecurity
Next
All Documents