Breach notification
A personal data breach notifies every affected Person and authority within the legal deadline, scoped by an exact query.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC7.3 | The entity evaluates security events to determine whether they are incidents that require a response. |
| SOC2 P6.3 | The entity keeps a complete, accurate and timely record of detected or reported unauthorized disclosures, including breaches. |
| SOC2 P6.6 | The entity notifies affected data subjects, regulators and others of breaches and incidents. |
| HIPAA 164.404 | A covered entity notifies each affected individual of a breach of unsecured protected health information without unreasonable delay. |
| GDPR Art.33 | A controller notifies the supervisory authority of a personal data breach within 72 hours where feasible. |
| GDPR Art.34 | A controller tells data subjects without undue delay about a breach likely to put them at high risk. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Incident that touched a personal field in the report period. |
| Assert | Each lists every affected Person, and every required notice went out within its legal deadline. |
Owner
Example
A leaked export token reads 312 tutoring-marketplace parents' emails. One query lists exactly those 312 People, and each one, plus the authority, gets notice inside 72 hours.