⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

Data Breach Response

Incident response and legal compliance for personal data breaches under GDPR Art. 33/34, CCPA, HIPAA, NIS2, PCI DSS, and other regulations. Calculates breach severity, tracks notification deadlines, and manages response timelines.

[Tools](#tools)
[Breach Severity Calculator](#breach-severity-calculator)
[Breach Timeline Tracker](#breach-timeline-tracker)
[Reference Guides](#reference-guides)
[Workflows](#workflows)
[ENISA Severity Formula](#enisa-severity-formula)
[Notification Decision Matrix](#notification-decision-matrix)
[Troubleshooting](#troubleshooting)
[Success Criteria](#success-criteria)
[Scope & Limitations](#scope--limitations)
[Anti-Patterns](#anti-patterns)
[Tool Reference](#tool-reference)

Tools

Breach Severity Calculator

Calculates ENISA breach severity score from breach parameters. Determines notification obligations based on severity verdict.

# Calculate severity from parameters
python scripts/breach_severity_calculator.py \
  --dpc 3 --ei 0.75 \
  --confidentiality 0.5 --integrity 0.25 --availability 0 \
  --malicious

# JSON output
python scripts/breach_severity_calculator.py \
  --dpc 2 --ei 0.5 --confidentiality 0.5 --json

# With T0 timestamp for countdown
python scripts/breach_severity_calculator.py \
  --dpc 3 --ei 1.0 --confidentiality 0.5 \
  --t0 "2026-04-10T08:00:00" --json

# Generate input template
python scripts/breach_severity_calculator.py --template

Output includes:

ENISA severity score (SE)
Severity verdict: LOW / MEDIUM / HIGH / VERY HIGH
Notification obligations (SA, data subjects, public)
Time remaining for GDPR 72h notification from T0

Breach Timeline Tracker

Tracks breach response timeline from T0 (moment of awareness). Records events, monitors deadlines, and generates status dashboards.

# Initialize a new breach timeline
python scripts/breach_timeline_tracker.py init \
  --breach-id "BR-2026-001" --t0 "2026-04-10T08:00:00" \
  --description "Unauthorized database access" \
  --output breach_timeline.json

# Record an event
python scripts/breach_timeline_tracker.py event \
  --timeline breach_timeline.json \
  --action "Containment team activated" --category containment

# View status dashboard
python scripts/breach_timeline_tracker.py status --timeline breach_timeline.json

# Check deadlines
python scripts/breach_timeline_tracker.py deadlines --timeline breach_timeline.json

# JSON status output
python scripts/breach_timeline_tracker.py status --timeline breach_timeline.json --json

Tracks:

GDPR 72-hour SA notification deadline
DPA contractual deadlines (24h / 48h processor notification)
NIS2 24-hour early warning and 72-hour notification
Completed vs. pending response actions
Time elapsed and time remaining per deadline

Reference Guides

ENISA Methodology

references/enisa_methodology.md

Complete ENISA breach severity methodology:

DPC (Data Processing Context) scoring 1-4
EI (Ease of Identification) scoring 0.25-1.00
CB (Circumstances of Breach) additive scoring
Formula: SE = (DPC x EI) + CB
Adjustments for encryption, pseudonymization, volume
EDPB case matching (18 reference cases)

Notification Obligations

references/notification_obligations.md

Multi-regulation notification requirements:

GDPR Art. 33 (SA within 72h) and Art. 34 (data subjects)
CCPA, HIPAA, PCI DSS, NIS2, state breach notification
Controller vs. Processor obligation matrix
Cross-border notification rules
AI Act Art. 62 serious incident reporting

Workflows

Workflow 1: Standard Breach Response

Step 1: Emergency check — is there <12h remaining on any deadline?
        → If yes, skip to Step 4 (emergency notification)

Step 2: Initialize breach timeline
        → python scripts/breach_timeline_tracker.py init --breach-id "BR-2026-001" \
          --t0 "2026-04-10T08:00:00" --description "Description"

Step 3: Calculate severity
        → python scripts/breach_severity_calculator.py --dpc N --ei N \
          --confidentiality N --integrity N --availability N [--malicious]

Step 4: Based on severity verdict, determine notifications
        → LOW (<2): Internal log only, no external notification
        → MEDIUM (2 to <3): Notify supervisory authority within 72h
        → HIGH (3 to <4): Notify SA + individual data subjects
        → VERY HIGH (>=4): Notify SA + data subjects + consider public notice

Step 5: Execute containment and record events
        → python scripts/breach_timeline_tracker.py event --timeline breach.json \
          --action "Action taken" --category containment

Step 6: Monitor deadlines continuously
        → python scripts/breach_timeline_tracker.py deadlines --timeline breach.json

Step 7: Complete notification obligations and document

Workflow 2: Emergency Mode (<12h Remaining)

Step 1: Calculate severity immediately
        → python scripts/breach_severity_calculator.py --dpc N --ei N \
          --confidentiality N --t0 "original-t0" --json

Step 2: If MEDIUM or higher, prepare phased notification
        → Art. 33(4) allows phased notification when full information unavailable
        → Initial notification: what is known + promise of update
        → Supplementary notification: full details when available

Step 3: File initial SA notification before deadline expires

Step 4: Initialize timeline for ongoing tracking
        → Continue gathering information for supplementary notification

Step 5: Document emergency timeline and decisions

Workflow 3: Processor Breach Notification

Step 1: Processor becomes aware of breach
        → T0 for processor = moment of awareness

Step 2: Processor must notify controller "without undue delay"
        → Check DPA for specific contractual deadline (24h/48h common)

Step 3: Controller's T0 starts when controller becomes aware
        → Controller's 72h clock starts at this point

Step 4: Controller assesses severity independently
        → python scripts/breach_severity_calculator.py (controller's assessment)

Step 5: Controller makes notification decisions
        → Processor provides information; controller decides on SA/subject notification

ENISA Severity Formula

SE = (DPC x EI) + CB

| Component | Range | Description | |-----------|-------|-------------| | DPC | 1-4 | Data Processing Context — nature and sensitivity of data | | EI | 0.25-1.0 | Ease of Identification — how easily individuals can be identified | | CB | -0.5 to +1.0 | Circumstances of Breach — additive factors (malicious intent, volume, loss type) |

Severity Verdicts

| Score Range | Verdict | Notification Obligations | |-------------|---------|--------------------------| | <2 | LOW | Internal log only. No SA or subject notification required | | 2 to <3 | MEDIUM | Notify supervisory authority within 72h (Art. 33) | | 3 to <4 | HIGH | Notify SA within 72h + notify individual data subjects (Art. 34) | | >=4 | VERY HIGH | Notify SA + data subjects + consider public notice; crisis management |

Notification Decision Matrix

Quick reference for notification obligations per regulation and severity.

| Regulation | Authority Notification | Individual Notification | Trigger | |------------|----------------------|------------------------|---------| | GDPR Art. 33 | SA within 72h | N/A | Unless unlikely to result in risk to rights/freedoms | | GDPR Art. 34 | N/A | Without undue delay | When likely to result in high risk | | CCPA | State AG | Affected consumers | Unencrypted personal information compromised | | HIPAA | HHS within 60 days | Affected individuals | Unsecured PHI; >500: notify media | |

data-breach-response

Como adicionar

Cole no README do seu repo

Skills relacionadas

internal-comms

smart-explore

babysit

do

Receba novas skills de DevOps e Infra toda segunda