Breach Response Plan
A step-by-step incident response plan template with escalation contacts, containment checklists, regulator notification drafts (GDPR, DPDP Act), and post-incident review guidance.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- Fill in the roles table on page 1 — who is the incident lead, who is the DPO, who approves regulator notification, who approves subject notification. These are decisions that get made in advance, not during the incident.
- Walk through the detection and containment runbook in Section 2. Replace the placeholder tools (SIEM, ticketing, communication channel) with the specific ones your team uses.
- Fill in the severity matrix in Section 3. The template includes a four-tier matrix (Low / Material / High / Critical) tied to notification timing — use /tools/data-breach-severity-calculator to validate the thresholds.
- Pre-draft the regulator and subject notification letters in Section 4. Doing this in advance is the single biggest latency saving when an incident fires.
- Rehearse quarterly. The plan is a drawer document until it's exercised; TruePrivacy customers run quarterly tabletop exercises against the plan.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Does the plan cover GDPR, DPDP, PDPA and UAE PDPL?+
Yes. Section 4 includes four notification tracks — GDPR's 72-hour supervisory authority notice, PDPA's 3-calendar-day PDPC filing, DPDP's without-delay DPBI notice plus the 72-hour report, and the UAE PDPL's as-soon-as-possible path. Delete the regulations that don't apply to you.
What's a 'notifiable' breach?+
Each regulation sets its own test. GDPR: likely risk to rights and freedoms. PDPA: significant harm OR 500+ individuals. DPDP: any personal data breach. CCPA: specific thresholds for ransomware and compromised credentials. Section 3 of the plan walks the four tests side by side.
Should every breach be reported to law enforcement?+
No. Law-enforcement notification is driven by the attack vector (ransomware, nation-state) not by the privacy breach itself. The plan includes a decision tree in Section 5 — report to CERT-In in India, local LE for ransomware, FBI's IC3 in the US. The privacy regulator is a separate track.
How long should I keep the incident file?+
Minimum seven years for most privacy regulators. Keep the raw evidence (logs, timeline, decision reasoning) plus the regulator correspondence in a sealed folder with chain-of-custody metadata.
What's the first-24-hour checklist?+
Section 2 of the plan is a prioritised 24-hour checklist: identify, contain, preserve evidence, assess scope, draft the initial regulator holding statement, convene the incident team. The checklist is the single most useful page under pressure.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes