workbook
Prepare and record an accountable personal data breach response
Prepare owners, timelines, evidence references, risk decisions, communications, remediation, and closure without copying sensitive payloads.
Non-persisted working reference
Use this workbook to prepare notes, evidence references, owners, decisions, and follow-up. Entries are temporary in this browser. Nothing entered on this page is saved. It is not submitted; enter the approved record in Privora Pro when the review is complete.
Browser-local worksheet
Prepare working answers
Entries are temporary in this browser. They are not submitted or saved. Enter approved records in Privora Pro.
0 of 49 prepared
Prepare and record an accountable personal data breach response
This blank workbook structures professional review; it does not make a notification decision, replace incident command, or prove external filing. Confirm current requirements and the facts of the incident with accountable reviewers.
Confidentiality control: Assign a neutral incident reference and restrict this workbook to the response team. Do not place raw incident payloads, credentials, full identity documents, or copied sensitive records in this workbook. Keep live evidence, personal data, forensic material, affected-person lists, and delivery records in approved systems. Use safe references here, then enter approved information in the correct Privora Pro client workspace.
Privora Pro remains the operating record after approved information is entered. This workbook is a preparation and review aid. Destroy or retain completed working copies according to the organization's authorized incident and records procedure.
Working-page controls
Record the workbook owner, current review state, and permitted audience. Use one version at a time. Mark estimates and disagreements clearly. Do not turn an empty field into a guessed answer merely to make the pack appear complete.
Add a concise working answer.
Neutral incident reference
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Workbook owner and role
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Current review date
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Approved confidentiality classification
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Safe incident command sheet
Name the response authority and the secure systems used for communication and evidence. Do not copy access details into this page. Confirm alternates so urgent work does not stop when one person is unavailable.
Add a concise working answer.
Incident lead and alternate
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
DPO or privacy decision owner and alternate
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Security or forensic lead and alternate
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Communications owner and approver
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Management reviewer with residual-risk authority
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Approved secure coordination location reference
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Awareness and fact timeline
Separate suspected incident time, discovery time, controller awareness, and later fact changes. State the source for each time in the narrative rather than adjusting dates to match an internal target.
Choose the relevant date.
Suspected incident date and time
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Initial discovery date and time
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Controller awareness date and time
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Basis and source for the controller awareness time
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Material fact and action timeline with source references
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Containment and evidence index
Summarize containment and reference evidence without reproducing it. Note whether an action was validated and what risk remains. Preserve provenance and access controls in the evidence repository.
Select the current decision.
Current containment status
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Containment actions, owners, times, and validation results
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Known or credible continuing exposure and escalation
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Evidence references, custodians, provenance, and access location
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Evidence preservation gaps and recovery owners
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Affected people, data, systems, and processors
Use categories and bounded estimates. Never list affected people here. Explain the method and limitations behind each estimate.
Capture the working notes, source, and decision context.
Affected-person categories and relevant vulnerability factors
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Approximate affected-person count or range
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Approximate affected-record count or range
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Estimate method, time produced, confidence, and limitations
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select every check that is complete.
Affected data categories
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Affected systems, processes, environments, and interfaces
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Processor or recipient involvement, notices, and outstanding facts
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Risk and notification decision record
Record the rights-and-freedoms analysis and the two distinct notification questions. Preserve dissent and reassessment triggers. The product does not decide these questions.
Capture the working notes, source, and decision context.
Potential harms to affected individuals
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Likelihood, severity, protection, vulnerability, and mitigation factors
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Is the breach likely to result in risk to rights and freedoms?
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Commission-notification decision rationale, evidence, and assumptions
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Is the breach likely to result in high risk to affected data subjects?
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Data-subject communication decision rationale and protective actions
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Decision owners, reviewers, approvals, dissent, and times
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Facts or events that will trigger reassessment
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Communications and phased information
Prepare messages from the approved fact set. Keep drafts clearly labelled and store recipient data elsewhere. The authorized operator remains responsible for external delivery and proof of delivery.
Add a concise working answer.
Commission notice preparer, approver, and delivery operator
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Unavailable notice details, owners, and expected availability
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Phased update sequence and without-undue-delay follow-up control
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Immediate data-subject communication audience, channel, language, and mitigation advice
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Approved version, audience, delivery time, channel, and evidence reference
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Remediation and residual risk
Track durable correction separately from immediate containment. Require evidence and reviewer acceptance before marking an item complete.
Capture the working notes, source, and decision context.
Remediation actions, accountable owners, dates, dependencies, and status
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Remediation validation method, result, period, and evidence reference
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Residual risk disposition
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
Monitoring signals, owners, duration, and escalation thresholds
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Closure and lessons
Confirm that decisions, communications, external evidence, open actions, and lessons are reconciled before closure. A stopped timer is not closure evidence.
Select every check that is complete.
Closure readiness checks
Select every check that is complete.
When approved, record the result in the matching Privora Pro workflow
Select the current decision.
Incident closure decision
Select the current decision.
When approved, record the result in the matching Privora Pro workflow
Capture the working notes, source, and decision context.
What helped, what delayed work, and what must change
Capture the working notes, source, and decision context.
When approved, record the result in the matching Privora Pro workflow
Choose the relevant date.
Next remediation or lessons review date
Choose the relevant date.
When approved, record the result in the matching Privora Pro workflow
Add a concise working answer.
Owner for entering approved records in Privora Pro
Add a concise working answer.
When approved, record the result in the matching Privora Pro workflow
Transfer and sign-off
Before transferring the working pack, confirm the correct tenant and client, remove unnecessary personal data, resolve contradictory entries, and retain only the approved operating summary. Generated notices remain drafts until reviewed and approved. Verify external delivery separately before recording submission status or a regulator reference.
Open the client breach register
Open this workflow in Privora Pro and follow the steps in this runbook.
Review response deadlines
Open this workflow in Privora Pro and follow the steps in this runbook.
Source: Nigeria Data Protection Act 2023, Section 40, especially subsections (1)–(4), (8), and (9)
Source: General Application and Implementation Directive 2025, Article 33, especially paragraphs (1)–(5)
Reviewer sign-off should confirm factual sufficiency, regulatory analysis, communication authority, external delivery evidence, and safe records handling. Escalate unresolved duties or disputed facts for qualified professional review.
Download this operating resource
Download the workbook
Use PDF for review and print. Use the editable DOCX when the team needs a working copy.