# Plan data breach notifications and draft the notices

Assesses risk of harm from a personal data breach, maps who must be told and by when, and drafts regulator and individual notices.

- Topic: Legal & Compliance
- Framework: RTF
- Level: Advanced
- Tags: Legal, Write, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/plan-data-breach-notifications-and-draft-the-notices

## Prompt

```text
Help me assess a personal data breach and plan notifications.

**What happened:** [facts known so far - how discovered, when, systems affected, whether data was accessed, exfiltrated, encrypted, or lost]
**When we became aware:** [DATE and TIME]
**Data involved:** [categories, including any sensitive, financial, health, or ID data; whether encrypted]
**Individuals affected:** [types, approximate numbers, countries or states of residence]
**Our role:** [controller / processor; vendor involved?]
**Containment status:** [DETAILS]
**Contracts with notification duties:** [e.g. customer DPAs requiring notice within X hours]
**Insurance:** [cyber policy? notice requirements?]

Give me:
1. **Facts vs. unknowns** - two lists; what we must find out next and from whom.
2. **Risk to individuals** - likelihood and severity of harm (identity theft, fraud, discrimination, distress), with reasoning.
3. **Notification map** - a table: Who (regulators, individuals, customers/controllers, insurers, banks, law enforcement) | Trigger | Deadline from awareness | Status. Mark every legal deadline [CONFIRM UNDER APPLICABLE LAW] - do not state them as fact.
4. **Privilege steps** - routing forensic work through counsel where appropriate [CONFIRM WITH COUNSEL].
5. **Draft notices** - a regulator notification (nature of the breach, categories and approximate numbers, likely consequences, measures taken, contact point) and a plain-English notice to affected individuals (what happened, what data, what we are doing, what they should do, how to reach us), with placeholders. No minimizing language ("no evidence of misuse") unless the facts support it.
6. **Holding statement** - 3-4 factual sentences for customer-facing teams if asked before notices go out.
7. **Incident log** - template recording decisions and their reasons.

Keep public statements factual; do not speculate about cause or attacker. Breach rules vary by jurisdiction and deadlines can be short; a qualified lawyer must confirm notification decisions immediately.
```

## What to fill in

- DATE and TIME
- types, approximate numbers, countries or states of residence
- controller / processor; vendor involved?
- DETAILS
- e.g. customer DPAs requiring notice within X hours
- cyber policy? notice requirements?
- CONFIRM UNDER APPLICABLE LAW
- CONFIRM WITH COUNSEL

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.