may have a wider interest in category of individual or b) [Privacy management of the breach. This is authority concerned. Officer/Compliance likely to include employees, the Manager] Determine who has media, clients and appropriate responsibility for c) other regulators or law enforcement notification ([Company], Stakeholders agencies. An engagement plan should or a client or vendor). depending on the be agreed at the earliest opportunity. circumstances of Develop engagement / Please note that depending on the the data breach communications plan. particular circumstances and on the (e.g. in this case legal advice gained from local Legal department, outside counsel, it may be legally Human Resources.) required to notify the persons affected, law enforcement and/or regulators at an earlier stage and more specifically within 72 hours for data breaches affecting European entities. Please refer to the table below for more information. 9 Continue convening team meetings, Continue reviewing breach Breach response as required. response strategy and progress team on actions list. 10 Continue updating the Executive N/A [Privacy Committee and Board of Directors, Officer/Compliance as appropriate. Manager] Notification and engagement with stakeholders In relation to notification, guidance from [the Legal department / external legal counsel] must be sought before engaging with staff or any external stakeholders to ensure information disclosed is accurate and does not expose us to undue risk. The [the Legal department / external legal counsel] will determine whether and how to notify data breaches, as notification requirements vary and inappropriate action may result in enforcement action. The table below provides an overview of best practices in relation to notifying the stakeholders. Notification of, or engagement with these stakeholders should take place in strict compliance with the engagement plan developed by the breach response team, and only by those persons explicitly authorised for such engagement. With the exception of personnel, we should carefully evaluate when to notify or communicate to the affected individuals, other third parties and authorities when this is not legally or contractually required.
may have a wider interest in management of the breach. This is likely to include employees, the media, clients and appropriate regulators or law enforcement agencies. An engagement plan should be agreed at the earliest opportunity. Please note that depending on the particular circumstances and on the legal advice gained from local outside counsel, it may be legally required to notify the persons affected, law enforcement and/or regulators at an earlier stage and more specifically within 72 hours for data breaches affecting European entities. Please refer to the table below for more information. category of individual or authority concerned. Determine who has responsibility for notification ([Company], or a client or vendor). Develop engagement / communications plan. b) [Privacy Officer/Compliance Manager] c) other Stakeholders depending on the circumstances of the data breach (e.g. in this case Legal department, Human Resources.) 9 Continue convening team meetings, as required. Continue reviewing breach response strategy and progress on actions list. Breach response team 10 Continue updating the Executive Committee and Board of Directors, as appropriate. N/A [Privacy Officer/Compliance Manager] Notification and engagement with stakeholders In relation to notification, guidance from [the Legal department / external legal counsel] must be sought before engaging with staff or any external stakeholders to ensure information disclosed is accurate and does not expose us to undue risk. The [the Legal department / external legal counsel] will determine whether and how to notify data breaches, as notification requirements vary and inappropriate action may result in enforcement action. The table below provides an overview of best practices in relation to notifying the stakeholders. Notification of, or engagement with these stakeholders should take place in strict compliance with the engagement plan developed by the breach response team, and only by those persons explicitly authorised for such engagement. With the exception of personnel, we should carefully evaluate when to notify or communicate to the affected individuals, other third parties and authorities when this is not legally or contractually required.
Data%20breach%20incident%20manual.DOCX