Incident Response¶

Privacy incidents require documented response procedures and potential regulatory notification. This guide covers regulatory requirements and how Dxtra supports incident documentation.

Regulatory Notification Requirements¶

GDPR (Articles 33-34)¶

Supervisory authority notification:

• Timeline: 72 hours from becoming aware of breach
• Trigger: Personal data breach likely to result in risk to individuals
• Content: Nature of breach, categories/numbers affected, DPO contact, likely consequences, mitigation measures

Individual notification:

• Timeline: Without undue delay
• Trigger: High risk to rights and freedoms of individuals
• Content: Clear description, DPO contact, likely consequences, mitigation measures

CCPA¶

• No specific notification timeline to attorney general
• Individual notification required for unauthorized access to unencrypted personal information
• Maintain records for compliance audits

State Breach Notification Laws¶

US state laws vary, typically requiring:

• Notification within 30-90 days
• Notification to state attorney general
• Notification to affected individuals
• Credit monitoring in some states

Compliance Issue Tracking¶

Dxtra provides compliance issue tracking through the dashboard. Each issue includes:

Access Control¶

Compliance issue access is restricted by role:

Incident Response Workflow¶

Phase 1: Detection and Assessment¶

1. Identify incident -- Log potential incident as compliance issue in the dashboard
2. Initial assessment -- Evaluate scope and potential impact
3. Classify severity -- Set priority (high/medium/low)
4. Document -- Record details in the issue description

Phase 2: Investigation¶

1. Scope determination -- Identify affected data and systems
2. Impact analysis -- Assess risk to data subjects
3. Evidence collection -- Gather logs and forensic data
4. Update records -- Document findings in the compliance issue

Phase 3: Notification Decision¶

Based on investigation, determine notification requirements:

Phase 4: Response and Recovery¶

1. Containment -- Implement immediate controls
2. Remediation -- Address root cause
3. Recovery -- Restore normal operations
4. Documentation -- Update compliance issue with actions taken

Phase 5: Post-Incident¶

1. Lessons learned -- Document improvements
2. Policy updates -- Revise procedures if needed
3. Close issue -- Update status to resolved
4. Audit trail -- Maintain records for future reference

Notification Documentation¶

DPA Notification Content¶

When notifying supervisory authorities, document:

• Nature of breach (categories of data, approximate numbers)
• Name and contact details of DPO
• Likely consequences of breach
• Measures taken or proposed

Individual Notification Content¶

When notifying affected individuals:

• Clear, plain language description
• Name and contact of DPO
• Likely consequences
• Measures taken and recommended actions

Risk Assessment¶

Factors to Consider¶

Common Incident Scenarios¶

Unauthorized Access¶

1. Log compliance issue with description of access detected
2. Assess scope: what data was accessible?
3. Determine if data was actually accessed or exfiltrated
4. Assess notification requirements based on risk
5. Document response actions

Data Exposure¶

1. Log compliance issue with exposure details
2. Identify duration of exposure
3. Determine if data was accessed during exposure
4. Implement containment measures
5. Assess notification requirements

Vendor Breach¶

1. Receive notification from vendor
2. Log compliance issue linked to processor
3. Coordinate with vendor on impact assessment
4. Determine your notification obligations
5. Document joint response

Implementation Checklist¶

• Establish incident response team with assigned roles
• Document internal escalation procedures
• Create notification templates for DPA and individuals
• Define risk assessment criteria
• Train staff on incident identification
• Test response procedures periodically
• Maintain contact list for legal, DPO, and management

Common Questions¶

How do we track the 72-hour notification deadline?¶

Monitor the compliance issue creation timestamp. The 72-hour deadline starts from when the organization becomes aware of the breach.

Can we generate notification documents from Dxtra?¶

Use compliance issue records as source data for drafting notification documents. Dxtra does not generate notification templates automatically.

How do we link incidents to affected data subjects?¶

Document affected data subject information in the compliance issue description. Use the Activity Log to identify affected processing activities.

For Auditors and Regulators¶

What Auditors Can Access¶

Related Documentation¶

• GDPR Implementation -- GDPR Articles 33-34 breach requirements
• Compliance Overview -- All compliance features
• Security and Compliance -- Security practices
• Data Controller Setup -- Initial configuration