Write a documented data breach notification plan

A written data breach notification plan documents who legally must be notified, within what timeframe, and through what process, if a real breach occurs, since most jurisdictions impose specific legal deadlines with real penalties for missing them.

Notification deadlines are often short, sometimes as little as 72 hours in some jurisdictions, and figuring out your legal obligations for the first time during an actual breach adds real, avoidable delay right when speed matters most.

How to do it

1. 1
   Identify your actual legal notification obligations

   Varies by jurisdiction and the type of data involved, worth confirming with an attorney if uncertain.
2. 2
   Document who needs to be notified and how

   Affected individuals, regulators if applicable, and the specific process for each.
3. 3
   Note the real legal deadlines

   So there is no ambiguity about the clock during an actual incident.
4. 4
   Connect this to your broader incident response plan

   Notification is one real piece of the overall response, not a separate disconnected process.