Data Breach Management
This workshop prepares the organisation to detect, assess and notify data breaches, with a clear procedure, a prepared notification decision and a practical exercise.
Workshop 11 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Awareness training that teaches every employee what a data breach is and how to report it
- Incident register with a built-in breach assessment checklist
- The notification rules and deadlines of your jurisdiction shown in every incident
- Template for the breach response procedure with notification templates
- Notification templates for the authority and for individuals in the Policy Framework
- Tabletop exercise template to plan and document the breach exercise
Workshop tasks
-
1. Definition & internal reporting
Every employee learns what a data breach is (email to the wrong recipient, lost device, compromised account, ransomware) and how to report it immediately in the ResGuard Awareness Training. You only define the internal reporting channel.
In ResGuard: Awareness Training -
2. Response procedure
Document the response team, immediate containment, fact-finding, escalation and lessons learned.
In ResGuard: Policy Framework -
3. Assessment & notification
Prepare the criteria for deciding whether to notify the PDPC and the affected individuals, and the timelines. The notification templates for the authority and for individuals are ready in the ResGuard Policy Framework.
In ResGuard: Policy Framework -
4. Breach register in ResGuard
Record every breach, including those not notified: facts, assessment, decision and corrective measures.
In ResGuard: Incident Response -
5. Simulation exercise
Test the procedure with a realistic personal data breach, for example a salary spreadsheet emailed to the wrong external recipient, and check whether the notification timelines would have been met. Plan and document it with the ResGuard tabletop exercise template and upload the documentation as evidence to the task.
In ResGuard: Policy Framework -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- Assess a suspected breach in a reasonable and expeditious manner; the PDPC expects this within 30 calendar days.
- A breach is notifiable if it results, or is likely to result, in significant harm to the affected individuals, or affects 500 or more individuals.
- Notify the PDPC as soon as practicable, and no later than 3 calendar days after determining that the breach is notifiable. Affected individuals must also be notified where there is significant harm, unless an exception applies.
Expected result
- All employees can recognise and report a data breach
- Response procedure approved
- Notification criteria, timelines and templates prepared
- Breach register kept in Incident Response
ResGuard modules: Incident Response, Awareness Training, Policy Framework