What’s inside the PDF:
- Roles with phone numbers: owner, deputy, DPO, regulatory decision-maker
- The first hour: stop, preserve, scope, notify
- The first day: breach assessment against the 72-hour clock, client corrections, vendor engagement
- Afterwards: a written record, the added control, updated training
The page only works if you’ve practised it. Once a year, make up an incident (“the drafting tool just emailed one client’s figures to a different client”) and walk through the page for twenty minutes. A gap found in a drill costs nothing. The same gap found during a real incident costs the afternoon you can least spare, and possibly a notification deadline.
The template follows the rule I run my own systems by: when something goes wrong, it gets fixed, the root cause gets written down, and a check is added that would have caught it. The agent governance guide covers the controls that make incidents rare. This template is for the day one happens anyway.
This page and the template are for information only. They aren’t regulated financial advice, legal advice or a compliance opinion. Adapt them with a qualified professional where regulation applies.