Data Breach Response Workflow

How do I set up this breach response workflow for my team?

Publish the template in your workspace and it's ready to run immediately, no installation needed. You'll want to assign the breach responder, privacy officer and legal roles to the right team members so tasks route to the correct people. The public request form is already built to capture reporter details and breach specifics, so reporters can submit through it right away.

Who is involved in responding to a breach, and what do they do?

A breach responder investigates the incident and records findings, containment status and harm likelihood. The privacy officer and legal reviewer then assess the case together and decide on notification obligations, recording their notes, decision and reasoning. If notification is required, the privacy officer carries it out and records what was sent and when, and the breach responder later completes remediation.

What happens at the notification decision step?

After the privacy officer and legal review, the workflow routes based on the Notification Decision they record. If the decision is to notify regulators and individuals, or individuals only, the record status moves to Notifying and the privacy officer is assigned to carry out and log those notifications. If no notification is required, the workflow moves straight to remediation.

Can I customise the request form or the steps in this workflow?

Yes. You can describe the change you want in plain English, or edit the steps directly in the workflow editor, including the fields on the request form. Earlier versions of the workflow are kept, so you can review what changed over time.

Does the reporter need an account to submit a breach report?

No. The reporter submits through a public request form and receives updates by email, including an acknowledgement with their reference number and a closure email at the end. They don't need to log in or create an account at any point.

How does the workflow track where a breach case stands?

Each breach becomes a record with a reference number and a status that moves through stages like Reported, Assessing, Notifying, Remediation and Closed. The record's timeline logs what happened at each step, and table views and dashboards let you see all cases grouped by status.

What gets saved on the record versus staying on a task?

Because the investigation, review, notification and remediation tasks all have the workflow waiting for them, the information entered on those tasks — findings, decisions, notifications made, remediation details — is saved directly on the breach record. This means anyone reviewing the record later can see the full picture without having to open individual tasks.

How long does it typically take to get this workflow running?

The template is ready to use as soon as it's published in your workspace, so there's no development or setup project involved. Most of your initial time will go into confirming who fills the breach responder, privacy officer and legal roles, and reviewing the request form fields to match your organisation's language.

Does this workflow decide whether we're legally required to notify regulators?

No, the workflow doesn't make that determination for you. It records the notification decision and reasoning entered by your privacy officer and legal reviewer during their review task, giving you a clear record of what was decided and why. Each business should confirm its own notification obligations based on applicable law.