Data breach response checklist

Use this checklist whenever personal data held by [Organization], or by a provider on our behalf, may have been lost, stolen, destroyed, altered, disclosed or accessed without authorization. A breach does not have to involve hackers. Common examples include:

• an email or attachment containing personal data sent to the wrong person;
• a lost or stolen laptop, phone, USB drive or paper file;
• a staff email account taken over by an attacker;
• ransomware or other malware on systems that hold personal data;
• customer or employee records shared, viewed or downloaded by someone who should not have access;
• personal data published on a website or social media page by mistake;
• records destroyed or altered without authorization, or lost because a backup failed.

If the breach comes from a cyberattack, follow our [incident response plan] at the same time. This checklist covers the data protection steps; the incident response plan covers containment and recovery of the systems.

• A data controller must report to the Information Commissioner any security breach that affects or may affect personal data, and any contravention of the data protection standards, within 72 hours of becoming aware of it.
• The 72 hours run from when we become aware of the breach. Weekends and public holidays count.
• The report must include prescribed details about the breach. The Information Commissioner's online breach report form allows a report to be made in phases, so report on time with what we know and follow up as we learn more.
• People whose personal data is affected must be notified as required by the regulations.
• Breaching the standards, or failing to make a required report, can be an offense. A company convicted of an offense can be fined up to 4% of its annual gross worldwide turnover, and some offenses can lead to imprisonment.
• Registration requirements for data controllers have been phased in. Check the Office of the Information Commissioner's website for current registration requirements.

• Report the suspected breach to the breach lead [name, phone]. If you cannot reach them, call the deputy [name, phone].
• Record the date and time we became aware of the breach. This starts the 72-hour clock. Deadline: [date and time].
• Open a breach reference [format, e.g. DB-2026-001] and start a log of every action, decision and time.
• Stop the breach from continuing: for example, recall a misdirected email, lock a lost device remotely, reset a compromised password, or remove data published by mistake.
• If the breach comes from a cyberattack, disconnect affected devices from the network but do not switch them off, and start the incident response plan.
• Ask anyone who received data by mistake to delete it, not to share it, and to confirm this in writing.
• Preserve evidence: keep emails, logs, screenshots and photographs. Do not delete anything.
• Tell management.
• Keep knowledge of the breach to the people who need to know.

• Complete the breach assessment worksheet (Appendix A) with the facts known so far.
• Identify the types of personal data involved, and whether any of it is sensitive personal data, such as health, biometric or criminal record information.
• Estimate how many people are affected, and in which groups: customers, employees, patients, students, members or others.
• Find out whether the data was encrypted or otherwise protected, and whether it has been recovered.
• Assess the likely consequences for the people affected, such as fraud, identity theft, financial loss, discrimination, damage to reputation or distress.
• If a service provider holds the data, get full written details from them and agree who will do what.
• Notify your insurer as your policy requires.
• If money may have been stolen or bank details exposed, contact the bank.
• Report to the police where a crime is suspected, such as theft or unauthorized access, and record the reference number.
• Consider reporting a cyberattack to the Jamaica Cyber Incident Response Team (JaCIRT) through its online form at cirt.gov.jm. This does not replace the report to the Information Commissioner.
• Take legal advice if the reporting position is unclear or the breach is serious.
• Brief management on the facts, the risk and the next steps.

• Decide whether the breach must be reported. If personal data is or may be affected, the starting point is that it must be. Record the decision and the reasons in the register (Appendix C).
• Draft the report using the facts in the breach assessment worksheet.
• Get the report approved by [management].
• Submit it through the "Report a Data Breach" form on the Office of the Information Commissioner's official website, before the 72-hour deadline. Check you are on the official site: the OIC has warned the public about a fraudulent website imitating it.
• If the facts are still incomplete, submit an initial report on time and say that follow-up information will be provided.
• Record the date and time of submission and the reference number the OIC gives.
• Diary dates for follow-up reports and send them as new facts emerge.

In general terms, the report describes:

• our organization, our contact person and Data Protection Officer, and any service provider involved;
• when the breach happened, when we became aware of it, how it was detected and its likely cause;
• whether the confidentiality, integrity or availability of personal data was affected;
• the types of personal data involved, and the approximate number and categories of people affected;
• the likely consequences for the people affected;
• what we have done and plan to do to contain the breach, reduce the harm and prevent it happening again, including any report to the police;
• whether, how and when the people affected have been or will be notified.

People whose personal data is affected must be notified as required by the regulations. The breach lead decides, with management and legal advice where needed, who must be told, when and how.

• Confirm who must be notified, and check the current regulations and any guidance from the Information Commissioner.
• Draft the notification using the checklist in Appendix B.
• Choose a channel that reaches people reliably and securely. Do not use a compromised email account or system to send it.
• Get the notification approved by the breach lead and [management].
• Brief front-line staff with a short script and answers to likely questions before notifications go out.
• Send the notifications and record who was notified, when and how.
• Warn people to be suspicious of calls, messages or emails that claim to come from us about the breach and ask for passwords, PINs or payments.
• Track questions and complaints, and answer them consistently.

• Confirm the breach is fully contained and the cause has been fixed.
• Send any follow-up or final report to the Information Commissioner.
• Complete the entry in the breach register (Appendix C).
• Hold a review within [10] working days: what happened, why, how we responded and what to change.
• Agree improvement actions with owners and due dates, such as encryption, multi-factor authentication, access reviews, training or changes to a process.
• Update policies, procedures, privacy notices and contracts with service providers where needed.
• Brief staff on the lessons learned, without naming individuals.
• Review this checklist and update it.

Keep these records for [period, e.g. at least six years] in a location with restricted access:

• the breach log and completed breach assessment worksheet;
• the report to the Information Commissioner, any follow-up reports and the OIC reference number;
• copies of notifications sent, with the list of people notified and dates;
• reports to the police, JaCIRT, the insurer, the bank and any regulator, with reference numbers;
• the review findings and the action plan;
• the breach register entry, including the reasons for any decision not to report or not to notify.