Check whether a security incident is a reportable breach
Works through the facts of an incident against notification rules and deadlines so you know what to raise with counsel.
The prompt
Help me assess whether a security incident may require breach notification.
What happened: [FACTS - e.g. "laptop stolen", "attacker accessed a mailbox for 3 days"]
Data involved: [types - names, emails, SSNs, health data, payment cards, credentials - and approximate number of records]
Was it encrypted? Key also exposed? [DETAILS]
Evidence of access or exfiltration: [confirmed / possible / ruled out, and how we know]
Whose data, and where they live: [employees, customers; countries and US states]
Our sector and obligations: [e.g. "healthcare (HIPAA)", "EU customers (GDPR)", "card data (PCI DSS)", contracts with notice clauses, cyber insurance]
When we discovered it: [DATE, TIME]
Work through:
1. Whether the data types are covered "personal data" or "protected information" under the laws and frameworks that apply to us.
2. Factors that typically affect reportability: encryption, actual vs. possible access, risk of harm.
3. Deadlines that may apply and when the clock may have started (e.g. GDPR's 72 hours to the regulator), with who must be notified: regulators, individuals, card brands, customers under contract, insurer.
4. Facts we still need to establish to decide.
Return: a summary table (Obligation | Applies? yes/no/possibly | Why | Deadline | Who to notify), the open questions, and an evidence log template.
This is general information to prepare for a conversation with legal counsel, not legal advice. Notification decisions must be made with a qualified lawyer, and deadlines can be short, so involve counsel immediately.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- DETAILS
- confirmed / possible / ruled out, and how we know
- employees, customers; countries and US states
- DATE, TIME
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.