A breach during an AI workflow

UK and EU | Keep this card with your out-of-hours contact list. Use a private copy of the incident workbook for a real event.

Before anything goes wrong

Name the duty lead and deputy, controller contact for each client, security engineer, privacy lead or DPO where appointed, safeguarding contact, insurer and relevant regulator routes. Test the phone tree outside working hours. Pre-authorise one person to disable a connector without waiting for the board. A solo founder can agree out-of-hours cover with a trusted provider under appropriate confidentiality terms. Keep a copy of the contact list available when company systems are down.

1 · Contain and preserve in parallel

The first responder opens an incident ID and records the first alert, source, time zone and what was observed. Take the affected connector, model action or shared link offline. Revoke exposed keys and sessions from a clean account, suspend cross-tenant search and use a manual fallback. Ask recipients and vendors to restrict further use, preserve necessary evidence and confirm containment. Use a safe device and approved channel. Keep exact actions, timestamps, model version and access logs under restricted access. Avoid spreading the exposed records in chat, consumer AI or an open issue tracker. NCSC · EDPB-EX

2 · Establish what happened to people’s data

A security breach can result in destruction, loss, alteration, unauthorised disclosure or access to personal data. Check confidentiality, integrity and availability. An invented AI answer alone does not show a security breach. A ransomware outage blocking a clinician’s access to time-critical records can affect people even if nobody copied the files. A leak of source code containing no personal data still goes through the contractual, security or sector incident route. Reassess if logs later identify people or records. EU-GDPR · UK-GDPR · ICO-BGUIDE · EDPB-EX

Separate a suspicion from the point when the organisation has a reasonable degree of certainty that a security incident compromised personal data. Investigate immediately. Log what was known at each point, the awareness timestamp and why. Escalating an already-known breach to the director on Monday does not restart the clock. Track the processor’s and controller’s own awareness separately. EDPB-BREACH · ICO-BGUIDE

3 · Identify your role for the affected purpose

A processor informs the controller without undue delay after becoming aware. Send the known facts through the agreed urgent route, even while scope and harm are being assessed. A shorter contractual deadline may apply. A subprocessor alerts its customer promptly through the agreed chain. Determine roles using the real activity. One business may be a processor for a customer inbox and a controller for its own employee records. Open separate notification decisions if both are affected. Record the handover, acknowledgement and updates. EU-GDPR · UK-GDPR · EDPB-BREACH · ICO-CONTRACT

4 · Decide on two different notification thresholds

The controller assesses likelihood and severity for the affected people. Consider identifiability, sensitivity, who could access the information, actual protection, duration, ability to withdraw access, dependency, physical safety, financial loss and reputational or discriminatory consequences. A single exposed shelter address may outweigh thousands of innocuous entries. “We have seen no misuse” needs supporting facts and does not resolve the assessment. EDPB-BREACH · ICO-BGUIDE

Regulator. Notify the competent authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to pose a risk to individuals’ rights and freedoms. Count elapsed hours, including weekends and holidays. Report what you know, explain any delay beyond 72 hours and supply the rest in stages without undue further delay. Record every confirmed personal data breach, its effects, remedial action and the reasons for each reporting decision, including a decision against notification. EU-GDPR · UK-GDPR · EDPB-BREACH · ICO-REPORT

People. If the breach is likely to result in a high risk to people’s rights and freedoms, communicate directly in clear language without undue delay. Assess Article 34(3) exceptions on evidence: effective protections actually applied to the affected data and making them unintelligible to outsiders, later measures ensuring the high risk is no longer likely, or disproportionate effort requiring an equally effective public or similar communication. Encryption at rest offers little comfort if a logged-in intruder saw readable records. Consider immediate protective advice while investigating and keep the communication decision under review. EU-GDPR · UK-GDPR · ICO-BGUIDE

5 · Use the correct reporting door

UK. Use the ICO’s UK GDPR reporting route. Record submission time, reference and follow-up owner. Confirm the right route if a sector-specific regime applies. ICO-REPORT · ICO-ROUTES

EU. Use the EDPB directory to reach the competent national authority’s form. For qualifying cross-border processing with an EEA main establishment, identify the competent lead authority. For a non-established controller within GDPR Article 3(2), the one-stop shop is unavailable. Notify each competent authority in the Member States where affected people reside when the reporting threshold is met. An EU representative alone does not create a main establishment. If both UK and EU regimes apply, assess and record each route. Check reporting language, local time representation and receipt. EDPB-DOORS · EDPB-BREACH · EU-GDPR

Parallel duties. Ask the regulated activity owner about separate customer, insurer, professional, sector and cyber-reporting obligations. For entities within the relevant national NIS2 rules or the EU financial-sector regime DORA, check the applicable incident definition and reporting route immediately. These clocks and recipients can differ. Any police or insurer contact is separate from the data-protection decision. ICO-ROUTES · EU-NIS2 · EU-DORA

6 · Send the first message

Processor to customer. “At [time and zone] we became aware of [confirmed event] affecting [service and tenant]. Known categories and estimated counts are [details or under investigation]. We have [containment]. Our secure incident contact is [contact]. Next update [time]. We will send new material facts promptly.” Record when the controller received it. EDPB-BREACH

Controller to authority. Record the nature of the breach, where possible categories and approximate numbers of affected people and of records, DPO or other contact, likely consequences, measures in place or planned and mitigation. Separate verified facts from estimates. Include awareness time, reasons for any delay and an owner and time for the next update. Use the authority’s form. EU-GDPR · ICO-REPORT · EDPB-BREACH

Controller to person. “On [date], [what happened in plain words]. This involved your [categories]. You may face [specific consequence]. We have [measures]. You can [practical steps]. Contact [trusted number or known channel] if you need help or an accessible format. Our next update is [date].” Tailor advice to the harm. For a compromised password, offer reset and session revocation. For a location exposure, agree a safe channel first. Never send a group email revealing other affected people. Verify a representative’s authority and safety before contacting them. ICO-BGUIDE · EDPB-BREACH

7 · Restore, prove the fix and close

Test the repair in an isolated environment. Verify tenant separation, identifiers, caches, indexes, outputs and support consoles. Restore a known-good backup and reapply subsequent deletion or restriction records before reconnecting. Use a controlled release, name the person accepting residual risk and set monitoring thresholds. Close only after follow-ups and regulator or customer requests have owners and dates. Restrict the incident evidence, record its retention basis, update the DPIA and rehearse the original failure. NCSC · EDPB-EX · ICO-ERASE

Twenty-minute tabletop · the weekend shift

All facts and dates below are fictional. Friday 6 November 2026, 16.45 UTC: a customer reports seeing an unexpected document title. At 17.10 the UK service operator confirms the retrieval tool displayed another tenant’s identifiable patient notes. It disables the connector and retains restricted logs. It processes these notes on both clinics’ instructions and alerts the affected controllers without undue delay, at 17.15. The example assumes the clinics first receive sufficiently clear information at 17.15. Each checks its own role and timestamp.

One controller finds a child’s identifiable diagnosis and home address were viewed by an unrelated recipient. The recipient’s ability to copy them is unknown. On these facts the team treats this as likely high risk. It urgently assesses the safest way to reach the child or authorised representative, sends protective information and files the applicable initial regulatory report on Friday. If a controller instead became aware at 17.15 UTC Friday, the 72-hour point would be Monday 9 November at 17.15 UTC. This is an outer reference where feasible, never a reason to wait. The operator keeps the customer updated, and authorises service resumption only after demonstrating isolation in both directions. EDPB-BREACH · ICO-BGUIDE

Counterexample. A properly encrypted device is lost. Evidence supports that the key remained separate and uncompromised, data are available from backup, and no other material harm is likely. The controller may conclude notification is unnecessary. Record the evidence and reopen if the key was also accessible. A reassurance that the laptop was password-protected is insufficient for that conclusion. EDPB-EX · EDPB-BREACH

Drill scoring

A colleague should be able to locate the regulator form and phone tree, identify whose awareness starts which clock, draft the first partial report, decide whether to contact people, explain an urgent safe-contact choice and demonstrate a clean restore. Record one real improvement, responsible person and due date. The exercise time and pass criteria are operating choices.

Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.