Incident Response

Incident Response (IR) is the operational discipline that turns a security alert into a bounded, documented outcome. The canonical NIST SP 800-61 phases — preparation, detection and analysis, containment / eradication / recovery, post-incident activity — map onto any mature programme. For privacy incidents specifically, each phase pairs with regulatory obligations: GDPR Articles 33 and 34 attach to the detection and notification phases; DPDP Rule 7 adds a 72-hour report; CERT-In directions add a 6-hour cyber-incident report regardless of personal-data content.

An effective IR capability has: a trained Incident Commander role; pre-mapped data flows so scope can be scoped in hours; pre-approved notification templates in every required language; a tabletop-tested chain of command between IR, Legal, DPO and Communications; pre-filed regulator contact details; and the forensic retainer / log retention needed to produce timely detailed reports. Regulators consider the quality of IR when setting penalties — GDPR Article 83(2) and DPDP Section 33(2) both weight 'action taken to mitigate'.