Skip to content
StartupBuilderby Startups.Studio
Workflows
Changelog
All Processes

Notify a breach

Notify a breach tells each regulator and affected Person about a personal-data breach within the legal deadline, which counts from awareness.

Trigger

Runs on Incident.created where personalData = true. Part of Notify regulator, run by the Legal Team.

Steps

  1. Record when the Startup became aware: every deadline counts from then.
  2. List the affected records, each Person they belong to, and their Markets.
  3. Draft each regulator notice from the Incident and the affected Markets.
  4. Send each notice before its deadline, signed where the law requires a signer.
  5. Tell each affected Person when the risk to them is high.

Outputs

Example

An Incident exposes the emails of 2,000 EU Customers. The regulator notice goes out 50 hours after the Startup became aware, inside the 72-hour deadline. No one is told directly, because exposed emails alone are low risk.