The Breach Management module provides a structured, end-to-end framework for managing data breach incidents from discovery through closure. Automated severity scoring and live SLA monitoring help teams prioritize incidents and stay ahead of critical notification deadlines. Dedicated workflow phases enable coordinated collaboration across Breach Management, IT Security, Legal, DPO, and Data Owners. Regulator and subject notifications, RCA/CAPA, approvals, and resubmissions are fully tracked within the incident record. Comprehensive audit trails and exportable reports provide the transparency and evidence needed for regulatory compliance and effective incident governance.
The designated Breach Manager raises a formal, template-driven Incident directly - there is no separate alert stage, so a confirmed breach moves straight into a structured, trackable process.
Severity is calculated as data sensitivity (1–5) × scale of impact (1–5), banded Low (≤8), Medium (≤15), High (≤20), or Critical (>20).
Incidents move through a linear pipeline - registration, containment, impact assessment, legal review, regulator notification, subject notification, RCA, CAPA, and closure; Legal recommends a notification level, and DPO approves, rejects, or overrides it to finalize the required action.
A scheduled job checks every incident's age against its registration/discovery time every 15 minutes: a warning escalation fires at 48 hours, a critical escalation at 60 hours, and the incident is flagged SLA-breached at 72 hours - all tracked per-incident so warnings aren't re-sent.
Org Admin configures which roles are eligible for each workflow step; the Breach Manager then assigns specific users from those eligible roles. The incident form is broken into assignable sections - intake, containment, impact assessment, legal recommendation, regulator notification, subject notification, RCA, CAPA, and closure - each tracked to completion.
IT Security submits a combined root-cause-analysis and corrective/preventive action package; the assigned Data Owner acknowledges or rejects it with justification, bouncing it back for resubmission if rejected, with resubmissions tracked by count.
Regulator notification is generated as a formal report; subject notification is sent by email with the incident details and a custom message, both logged against the incident's notification tracker.
Org Admin/DPO build the incident-response template itself - custom fields and sub-sections, publish, unpublish with a required reason, and new template versions with a reason - giving the breach form the same versioned lifecycle as ROPA, DPIA, and Policy templates.
Every action - status change, gate decision, assignment - is logged with actor, role, previous/new status, phase, timestamp, and IP address; a full incident report exports as structured JSON or a generated PDF covering the summary, legal gate outcome, RCA/CAPA acknowledgement, and notification log.
Containment itself splits into general, IT, and DPO-facing sub-sections, so technical lockdown, IT-specific remediation, and DPO oversight can all proceed in parallel instead of waiting on a single owner.
Talk to our team to see a live demo tailored to your requirements.
Fill in the form below and our team will get back to you shortly.