# Check whether a security incident is a reportable breach

Works through the facts of an incident against notification rules and deadlines so you know what to raise with counsel.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/check-whether-a-security-incident-is-a-reportable-breach

## Prompt

```text
Help me assess whether a security incident may require breach notification.

**What happened:** [FACTS - e.g. "laptop stolen", "attacker accessed a mailbox for 3 days"]
**Data involved:** [types - names, emails, SSNs, health data, payment cards, credentials - and approximate number of records]
**Was it encrypted? Key also exposed?** [DETAILS]
**Evidence of access or exfiltration:** [confirmed / possible / ruled out, and how we know]
**Whose data, and where they live:** [employees, customers; countries and US states]
**Our sector and obligations:** [e.g. "healthcare (HIPAA)", "EU customers (GDPR)", "card data (PCI DSS)", contracts with notice clauses, cyber insurance]
**When we discovered it:** [DATE, TIME]

Work through:
1. Whether the data types are covered "personal data" or "protected information" under the laws and frameworks that apply to us.
2. Factors that typically affect reportability: encryption, actual vs. possible access, risk of harm.
3. Deadlines that may apply and when the clock may have started (e.g. GDPR's 72 hours to the regulator), with who must be notified: regulators, individuals, card brands, customers under contract, insurer.
4. Facts we still need to establish to decide.

Return: a summary table (Obligation | Applies? yes/no/possibly | Why | Deadline | Who to notify), the open questions, and an evidence log template.

This is general information to prepare for a conversation with legal counsel, not legal advice. Notification decisions must be made with a qualified lawyer, and deadlines can be short, so involve counsel immediately.
```

## What to fill in

- DETAILS
- confirmed / possible / ruled out, and how we know
- employees, customers; countries and US states
- DATE, TIME

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.