PrivoraPrivora
Breach response workbook

workbook

Prepare and record an accountable personal data breach response

Prepare owners, timelines, evidence references, risk decisions, communications, remediation, and closure without copying sensitive payloads.

Non-persisted working reference

Use this workbook to prepare notes, evidence references, owners, decisions, and follow-up. Entries are temporary in this browser. Nothing entered on this page is saved. It is not submitted; enter the approved record in Privora Pro when the review is complete.

Browser-local worksheet

Prepare working answers

Entries are temporary in this browser. They are not submitted or saved. Enter approved records in Privora Pro.

Workbook preparation actions

0 of 49 prepared

Nothing is saved. Mark each field prepared when its working answer is ready.

Prepare and record an accountable personal data breach response

This blank workbook structures professional review; it does not make a notification decision, replace incident command, or prove external filing. Confirm current requirements and the facts of the incident with accountable reviewers.

Confidentiality control: Assign a neutral incident reference and restrict this workbook to the response team. Do not place raw incident payloads, credentials, full identity documents, or copied sensitive records in this workbook. Keep live evidence, personal data, forensic material, affected-person lists, and delivery records in approved systems. Use safe references here, then enter approved information in the correct Privora Pro client workspace.

Privora Pro remains the operating record after approved information is entered. This workbook is a preparation and review aid. Destroy or retain completed working copies according to the organization's authorized incident and records procedure.

Working-page controls

Record the workbook owner, current review state, and permitted audience. Use one version at a time. Mark estimates and disagreements clearly. Do not turn an empty field into a guessed answer merely to make the pack appear complete.

Add a concise working answer.

Neutral incident reference

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Workbook owner and role

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Choose the relevant date.

Current review date

Not prepared

Choose the relevant date.

When approved, record the result in the matching Privora Pro workflow

Select the current decision.

Approved confidentiality classification

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Safe incident command sheet

Name the response authority and the secure systems used for communication and evidence. Do not copy access details into this page. Confirm alternates so urgent work does not stop when one person is unavailable.

Add a concise working answer.

Incident lead and alternate

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

DPO or privacy decision owner and alternate

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Security or forensic lead and alternate

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Communications owner and approver

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Management reviewer with residual-risk authority

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Approved secure coordination location reference

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Awareness and fact timeline

Separate suspected incident time, discovery time, controller awareness, and later fact changes. State the source for each time in the narrative rather than adjusting dates to match an internal target.

Choose the relevant date.

Suspected incident date and time

Not prepared

Choose the relevant date.

When approved, record the result in the matching Privora Pro workflow

Choose the relevant date.

Initial discovery date and time

Not prepared

Choose the relevant date.

When approved, record the result in the matching Privora Pro workflow

Choose the relevant date.

Controller awareness date and time

Not prepared

Choose the relevant date.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Basis and source for the controller awareness time

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Material fact and action timeline with source references

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Containment and evidence index

Summarize containment and reference evidence without reproducing it. Note whether an action was validated and what risk remains. Preserve provenance and access controls in the evidence repository.

Select the current decision.

Current containment status

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Containment actions, owners, times, and validation results

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Known or credible continuing exposure and escalation

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Evidence references, custodians, provenance, and access location

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Evidence preservation gaps and recovery owners

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Affected people, data, systems, and processors

Use categories and bounded estimates. Never list affected people here. Explain the method and limitations behind each estimate.

Capture the working notes, source, and decision context.

Affected-person categories and relevant vulnerability factors

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Approximate affected-person count or range

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Approximate affected-record count or range

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Estimate method, time produced, confidence, and limitations

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Select every check that is complete.

Affected data categories

Not prepared

Select every check that is complete.

Affected data categories

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Affected systems, processes, environments, and interfaces

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Processor or recipient involvement, notices, and outstanding facts

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Risk and notification decision record

Record the rights-and-freedoms analysis and the two distinct notification questions. Preserve dissent and reassessment triggers. The product does not decide these questions.

Capture the working notes, source, and decision context.

Potential harms to affected individuals

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Likelihood, severity, protection, vulnerability, and mitigation factors

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Select the current decision.

Is the breach likely to result in risk to rights and freedoms?

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Commission-notification decision rationale, evidence, and assumptions

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Select the current decision.

Is the breach likely to result in high risk to affected data subjects?

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Data-subject communication decision rationale and protective actions

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Decision owners, reviewers, approvals, dissent, and times

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Facts or events that will trigger reassessment

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Communications and phased information

Prepare messages from the approved fact set. Keep drafts clearly labelled and store recipient data elsewhere. The authorized operator remains responsible for external delivery and proof of delivery.

Add a concise working answer.

Commission notice preparer, approver, and delivery operator

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Unavailable notice details, owners, and expected availability

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Phased update sequence and without-undue-delay follow-up control

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Immediate data-subject communication audience, channel, language, and mitigation advice

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Approved version, audience, delivery time, channel, and evidence reference

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Remediation and residual risk

Track durable correction separately from immediate containment. Require evidence and reviewer acceptance before marking an item complete.

Capture the working notes, source, and decision context.

Remediation actions, accountable owners, dates, dependencies, and status

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Remediation validation method, result, period, and evidence reference

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Select the current decision.

Residual risk disposition

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

Monitoring signals, owners, duration, and escalation thresholds

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Closure and lessons

Confirm that decisions, communications, external evidence, open actions, and lessons are reconciled before closure. A stopped timer is not closure evidence.

Select every check that is complete.

Closure readiness checks

Not prepared

Select every check that is complete.

Closure readiness checks

When approved, record the result in the matching Privora Pro workflow

Select the current decision.

Incident closure decision

Not prepared

Select the current decision.

When approved, record the result in the matching Privora Pro workflow

Capture the working notes, source, and decision context.

What helped, what delayed work, and what must change

Not prepared

Capture the working notes, source, and decision context.

When approved, record the result in the matching Privora Pro workflow

Choose the relevant date.

Next remediation or lessons review date

Not prepared

Choose the relevant date.

When approved, record the result in the matching Privora Pro workflow

Add a concise working answer.

Owner for entering approved records in Privora Pro

Not prepared

Add a concise working answer.

When approved, record the result in the matching Privora Pro workflow

Transfer and sign-off

Before transferring the working pack, confirm the correct tenant and client, remove unnecessary personal data, resolve contradictory entries, and retain only the approved operating summary. Generated notices remain drafts until reviewed and approved. Verify external delivery separately before recording submission status or a regulator reference.

Open the client breach register

Open this workflow in Privora Pro and follow the steps in this runbook.

Review response deadlines

Open this workflow in Privora Pro and follow the steps in this runbook.

Source: Nigeria Data Protection Act 2023, Section 40, especially subsections (1)–(4), (8), and (9)

Source: General Application and Implementation Directive 2025, Article 33, especially paragraphs (1)–(5)

Reviewer sign-off should confirm factual sufficiency, regulatory analysis, communication authority, external delivery evidence, and safe records handling. Escalate unresolved duties or disputed facts for qualified professional review.

Download this operating resource

Download the workbook

Use PDF for review and print. Use the editable DOCX when the team needs a working copy.