A breach workflow with a clock — not a Slack channel.

A breach mishandled is worse than the breach itself.

Missed notification windows, unclear scope and inconsistent communications turn a technical incident into a public failure and a regulatory finding.

DPDP §8(6) requires the Data Fiduciary to intimate the Board and each affected data principal of a personal data breach in the form and manner prescribed.

Response cannot be improvised at 2am.

The clock starts on detection. The Board template must be ready. The data-principal notification must be ready. The scope must cite real inventory records.

• 72-hour clock on detection with escalation.
• Scope cites systems, applications and vendors from the inventory.
• Board notification template pre-approved by legal.
• Data-principal notification per affected cohort.
• Remediation tasks with named owners and closure evidence.

Detect, triage, notify, remediate, close.

One workflow across incident types, with the clock and templates pre-agreed.

1. 01
   Detect

   Incident opened; clock starts; scope drafted against the inventory.
2. 02
   Triage

   Severity assigned; legal, DPO and IR lead notified.
3. 03
   Notify Board

   Board notification issued under §8(6) with template pack.
4. 04
   Notify Principals

   Data-principal notification per affected cohort with contact evidence.
5. 05
   Remediate

   Tasks assigned to owners with closure evidence.
6. 06
   Close

   Post-incident report with lessons and control changes.

A file the Board can review and the regulator can request.

Every step timestamped. Every notification with evidence. Every remediation task with closure.

The programme's worst day, handled to plan.

No improvisation. No missed windows. The response is the plan you rehearsed.

Grounded in

DPDP §8(6)

Clock

72 hours

Templates

Board · Principal