Plan data breach notifications and draft the notices
Assesses risk of harm from a personal data breach, maps who must be told and by when, and drafts regulator and individual notices.
The prompt
Help me assess a personal data breach and plan notifications.
What happened: [facts known so far - how discovered, when, systems affected, whether data was accessed, exfiltrated, encrypted, or lost]
When we became aware: [DATE and TIME]
Data involved: [categories, including any sensitive, financial, health, or ID data; whether encrypted]
Individuals affected: [types, approximate numbers, countries or states of residence]
Our role: [controller / processor; vendor involved?]
Containment status: [DETAILS]
Contracts with notification duties: [e.g. customer DPAs requiring notice within X hours]
Insurance: [cyber policy? notice requirements?]
Give me:
1. Facts vs. unknowns - two lists; what we must find out next and from whom.
2. Risk to individuals - likelihood and severity of harm (identity theft, fraud, discrimination, distress), with reasoning.
3. Notification map - a table: Who (regulators, individuals, customers/controllers, insurers, banks, law enforcement) | Trigger | Deadline from awareness | Status. Mark every legal deadline [CONFIRM UNDER APPLICABLE LAW] - do not state them as fact.
4. Privilege steps - routing forensic work through counsel where appropriate [CONFIRM WITH COUNSEL].
5. Draft notices - a regulator notification (nature of the breach, categories and approximate numbers, likely consequences, measures taken, contact point) and a plain-English notice to affected individuals (what happened, what data, what we are doing, what they should do, how to reach us), with placeholders. No minimizing language ("no evidence of misuse") unless the facts support it.
6. Holding statement - 3-4 factual sentences for customer-facing teams if asked before notices go out.
7. Incident log - template recording decisions and their reasons.
Keep public statements factual; do not speculate about cause or attacker. Breach rules vary by jurisdiction and deadlines can be short; a qualified lawyer must confirm notification decisions immediately.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- DATE and TIME
- types, approximate numbers, countries or states of residence
- controller / processor; vendor involved?
- DETAILS
- e.g. customer DPAs requiring notice within X hours
- cyber policy? notice requirements?
- CONFIRM UNDER APPLICABLE LAW
- CONFIRM WITH COUNSEL
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Write up quality system audit findings against ISO 9001 or IATF 16949Clear, evidence-based audit findings with clause references, graded nonconformities, and a summary for management review.
- Write the quarterly report to the audit or risk committeeProduces a concise committee report covering plan progress, key findings, overdue actions, and the matters that need their attention.
- Write a clear disposition note for an AML or sanctions alertDrafts a well-reasoned alert or case disposition that documents what was reviewed, why, and the decision, ready for QA.
- Draft a contract from a term sheetA first-pass commercial contract built from agreed terms, for lawyer review.