What’s inside the PDF:
- Roles with phone numbers: owner, deputy, DPO, regulatory decision-maker
- The first hour: stop, preserve, scope, notify
- The first day: breach assessment against the 72-hour clock, client corrections, vendor engagement
- The after: written record, the added control, updated training
A tabletop drill makes the page real: once a year, invent an incident, “the drafting tool just emailed the wrong client’s figures to a client”, and walk the page for twenty minutes. Every gap the drill finds costs nothing; the same gap during a real incident costs the afternoon you least can spare, and possibly a notification deadline.
This page borrows the discipline that runs my own systems: incidents get logged, root-caused in writing, and each one adds the control that would have prevented it, so the same mistake cannot recur quietly. The agent governance guide covers the controls that make incidents rare; this template covers the day one happens anyway.
This page and the template are for informational purposes only and do not constitute regulated financial advice, legal advice, or a compliance opinion. Adapt with a qualified professional where regulation applies.