[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFFD810E54C91AP04M9ZEC":3,"skill-same:01M6AFFD810E54C91AP04M9ZEC":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6AFFD810E54C91AP04M9ZEC","breach-response-playbook",null,"Builds a comprehensive breach response team playbook defining CSIRT and privacy team structure with named roles (incident commander, legal counsel, communications, IT forensics, DPO), escalation matrices, communication templates, pre-negotiated vendor contacts, and regulatory authority contacts organized by jurisdiction. Keywords: breach response playbook, CSIRT, incident response team, escalation matrix, communication templates, vendor contacts.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34],"breach response playbook","playbook","incident response","communication","forensics","privacy","DPO","incident-response","data","escalation","templates","2026-11-10 10:12:30",false,"---\nname: breach-response-playbook\ndescription: >-\n  Builds a comprehensive breach response team playbook defining CSIRT and privacy\n  team structure with named roles (incident commander, legal counsel, communications,\n  IT forensics, DPO), escalation matrices, communication templates, pre-negotiated\n  vendor contacts, and regulatory authority contacts organized by jurisdiction.\n  Keywords: breach response playbook, CSIRT, incident response team, escalation\n  matrix, communication templates, vendor contacts.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: data-breach-response\n  tags: \"breach-playbook, csirt, incident-response-team, escalation-matrix, communication-templates\"\n---\n\n# Building Breach Response Team Playbook\n\n## Overview\n\nA breach response team playbook is the operational manual that enables rapid, coordinated response when a personal data breach occurs. It pre-defines roles and responsibilities, escalation paths, communication templates, and external contact information so that the response team can act immediately without spending critical hours on logistics during an actual incident.\n\n## Team Structure — CSIRT + Privacy Integration\n\n### Core Response Team\n\n| Role | Primary | Backup | Contact | Responsibility |\n|------|---------|--------|---------|---------------|\n| Incident Commander (IC) | Thomas Brenner (CISO) | Marcus Weber (SOC Lead) | +49 30 7742 8100 \u002F ic@stellarpayments.eu | Overall coordination, resource allocation, containment decisions |\n| Data Protection Officer | Dr. Elena Vasquez | Anna Schmidt (Deputy DPO) | +49 30 7742 8001 \u002F dpo@stellarpayments.eu | Notification decisions, risk assessment, regulatory liaison, data subject communication |\n| Legal Counsel | Sarah Chen (General Counsel) | External: Dr. Klaus Fischer (Freshfields) | +49 30 7742 8200 \u002F legal@stellarpayments.eu | Legal advice, privilege management, regulatory strategy, law enforcement coordination |\n| IT Forensics Lead | Petra Hoffmann (IT Director) | External: Sarah Mitchell (Mandiant) | +49 30 7742 8300 \u002F it-forensics@stellarpayments.eu | Evidence preservation, forensic investigation, scope determination, root cause analysis |\n| Communications Lead | Martin Keller (Comms Director) | Lisa Braun (Senior Comms Manager) | +49 30 7742 8400 \u002F comms@stellarpayments.eu | Media response, customer communication, internal communication, social media monitoring |\n| Executive Sponsor | Marcus Lindqvist (CEO) | CFO: Dr. Andrea Hoffmann | +49 30 7742 8000 \u002F ceo@stellarpayments.eu | Strategic decisions, board notification, public statements, regulatory engagement |\n| Customer Relations | James Park (VP Customer Success) | Maria Santos (Customer Success Director) | +49 30 7742 5000 \u002F customers@stellarpayments.eu | Customer inquiry management, B2B client communication, service status updates |\n| HR Lead | Claudia Richter (CHRO) | Stefan Müller (HR Director) | +49 30 7742 7500 \u002F hr-confidential@stellarpayments.eu | Employee communication, Works Council coordination, insider threat scenarios |\n\n### Extended Team (Activated as Needed)\n\n| Role | Contact | Activation Trigger |\n|------|---------|-------------------|\n| Board Liaison | Board Secretary (Dr. Friedrich Weber) | Breach affecting 10,000+ data subjects or likely to result in high risk |\n| Cyber Insurance | Allianz Claims: +49 89 3800 0 (ref: SPG-CYB-2025-001) | Any breach likely to exceed EUR 50,000 in response costs |\n| External IR Firm | Mandiant: +1 703 935 1700 (retainer: SPG-IR-2025-007) | Any breach requiring forensic investigation beyond SOC capability |\n| External Legal | Freshfields: +49 30 20 28 39 000 (ref: SPG-LEG-2025-012) | Breach involving regulatory risk, litigation risk, or cross-border notification |\n| External Communications | Brunswick Group: +49 69 2400 5510 | Breach with media exposure or affecting 50,000+ individuals |\n| Credit Monitoring Vendor | Experian Enterprise: +44 115 941 0888 (retainer: SPG-EXP-2025-003) | Breach involving financial data, government IDs, or health data |\n\n## Escalation Matrix\n\n### Severity Classification\n\n| Severity | Criteria | Response Time | Escalation Level |\n|----------|----------|---------------|-----------------|\n| SEV-1 (Critical) | 10,000+ data subjects; special category data (Art. 9); ongoing exfiltration; ransomware with encryption | Immediate (within 15 minutes) | IC + DPO + CEO + General Counsel |\n| SEV-2 (High) | 1,000-10,000 data subjects; financial data; credentials; media exposure | Within 30 minutes | IC + DPO + General Counsel |\n| SEV-3 (Medium) | 100-1,000 data subjects; non-sensitive personal data; contained breach | Within 2 hours | IC + DPO |\n| SEV-4 (Low) | Under 100 data subjects; low-sensitivity data; contained with no exfiltration | Within 4 hours | SOC Lead + Privacy Coordinator |\n\n### Escalation Flow\n\n```\nSOC Analyst detects alert\n    ↓\nSOC Lead validates (within 15 min)\n    ↓\nPersonal data involved? → No → Standard security incident process\n    ↓ Yes\nClassify severity (SEV-1 to SEV-4)\n    ↓\nSEV-1\u002F2: Activate Incident Commander + DPO immediately\nSEV-3: Notify IC + DPO within 2 hours\nSEV-4: Notify Privacy Coordinator within 4 hours\n    ↓\nIC convenes Core Response Team\n    ↓\n72-hour Art. 33 clock determination\n    ↓\nInvestigation → Risk Assessment → Notification Decision\n```\n\n## Communication Templates\n\n### Template 1: Internal Breach Alert (Email to Core Response Team)\n\n**Subject: [SEV-X] PERSONAL DATA BREACH — Immediate Action Required**\n\n**From**: SOC \u002F Incident Commander\n**To**: Core Response Team distribution list\n\nA personal data breach has been identified requiring immediate response.\n\n**Incident Summary:**\n- Discovery time: [UTC timestamp]\n- Affected system(s): [system names]\n- Breach type: [Confidentiality \u002F Integrity \u002F Availability]\n- Estimated data subjects: [count or range]\n- Personal data categories: [list]\n- Containment status: [Contained \u002F Active \u002F Unknown]\n\n**Immediate Actions Required:**\n- IC: Convene response team call at [time] on [bridge\u002FTeams link]\n- DPO: Begin risk assessment; determine 72-hour deadline\n- IT Forensics: Preserve evidence on affected systems\n- Legal: Review for privilege and law enforcement considerations\n- Communications: Prepare holding statement; monitor media\n\n**Response Team Bridge**: [Teams meeting link]\n**Incident Channel**: Signal group \"SPG-IR-Active\"\n\n### Template 2: Media Holding Statement\n\nStellar Payments Group is aware of a security incident affecting [some of our systems \u002F our customer database]. We immediately activated our incident response procedures and are working with leading cybersecurity experts to investigate the matter. The protection of our customers' data is our highest priority. We will provide further information as our investigation progresses. For media inquiries, please contact press@stellarpayments.eu.\n\n### Template 3: Customer Service Talking Points\n\n**For customer-facing staff during an active breach:**\n\nIf a customer asks about a security incident:\n- \"We are aware of a security issue and our team is actively working to resolve it.\"\n- \"The security of your information is our top priority.\"\n- \"We will communicate directly with any affected customers as soon as our investigation allows.\"\n- \"I can take your contact details and ensure you are notified if your account is affected.\"\n\nDo NOT:\n- Confirm or deny specific details of the breach\n- Speculate on the number of affected customers\n- Provide information not in the approved talking points\n- Discuss the incident on social media\n\n### Template 4: Board Notification (Email to Board Chair)\n\n**Subject: Data Breach Notification to the Board — [Breach Reference]**\n\nDear [Board Chair],\n\nI am writing to inform you of a personal data breach that occurred on [date]. This notification is provided in accordance with our Board-approved Incident Escalation Policy.\n\n**Summary**: [2-3 sentence description]\n**Scale**: [approximate data subjects and data categories]\n**Status**: [contained\u002Funder investigation]\n**Regulatory notification**: [filed\u002Fpending\u002Fnot required]\n**Financial exposure**: [estimated response costs and potential regulatory penalties]\n\nA full briefing will be provided at [scheduled time]. In the interim, [CEO name] is overseeing the organizational response.\n\n### Template 5: Employee Communication (All-Staff)\n\n**Subject: Important Update from [CEO] Regarding a Security Incident**\n\nDear Colleagues,\n\nI want to share an important update. On [date], we identified a security incident affecting [description]. Our security and privacy teams are working around the clock to investigate and resolve the situation.\n\n**What we know**: [brief, factual description]\n**What we are doing**: [containment and investigation actions]\n**What this means for you**: [if employee data was involved, say so directly; if not, clarify]\n**What we ask of you**: Report any unusual system activity to security@stellarpayments.eu. Do not discuss this matter externally or on social media.\n\nWe will provide updates as we learn more. Thank you for your professionalism and support during this time.\n\n[CEO Name]\n\n## Regulatory Authority Contact Directory\n\n### European Union\n\n| Country | Authority | Breach Portal \u002F Contact | Phone |\n|---------|-----------|------------------------|-------|\n| Germany (Berlin) | Berliner BfDI | datenschutz-berlin.de | +49 30 13889 0 |\n| Germany (Federal) | BfDI | bfdi.bund.de | +49 228 997799 0 |\n| France | CNIL | notifications.cnil.fr\u002Fnotifications | +33 1 53 73 22 22 |\n| Ireland | DPC | forms.dataprotection.ie | +353 57 868 4800 |\n| Netherlands | AP | autoriteitpersoonsgegevens.nl | +31 70 888 8500 |\n| Spain | AEPD | sedeagpd.gob.es | +34 91 266 35 17 |\n| Italy | Garante | protocollo@pec.gpdp.it | +39 06 696 77 1 |\n| Belgium | APD\u002FGBA | gegevensbeschermingsautoriteit.be | +32 2 274 48 00 |\n| Austria | DSB | dsb.gv.at | +43 1 52 152 0 |\n| Poland | UODO | uodo.gov.pl | +48 22 531 03 00 |\n\n### United Kingdom\n\n| Authority | Portal | Phone |\n|-----------|--------|-------|\n| ICO | ico.org.uk\u002Ffor-organisations\u002Freport-a-breach | +44 303 123 1113 |\n\n### United States\n\n| Authority | Portal | Phone |\n|-----------|--------|-------|\n| HHS\u002FOCR (HIPAA) | ocrportal.hhs.gov | +1 800 368 1019 |\n| California AG | oag.ca.gov\u002Fprivacy\u002Fdatabreach\u002Freporting | +1 916 210 6276 |\n| New York AG | ag.ny.gov\u002Finternet\u002Ffiling-a-complaint | +1 800 771 7755 |\n| FTC | ftc.gov\u002Fenforcement | +1 877 382 4357 |\n\n### Other International\n\n| Jurisdiction | Authority | Contact |\n|-------------|-----------|---------|\n| Canada | OPC | priv.gc.ca | +1 819 994 5444 |\n| Australia | OAIC | oaic.gov.au\u002Fprivacy\u002Fnotifiable-data-breaches | +1300 363 992 |\n| Brazil | ANPD | gov.br\u002Fanpd | +55 61 2025 8900 |\n| Singapore | PDPC | pdpc.gov.sg | +65 6377 3131 |\n\n## Pre-Negotiated Vendor Contacts\n\n| Service | Vendor | Contract Reference | Activation Contact | SLA |\n|---------|--------|-------------------|-------------------|-----|\n| Incident Response | Mandiant | SPG-IR-2025-007 | +1 703 935 1700 \u002F ir@mandiant.com | On-site within 24 hours, remote within 4 hours |\n| External Legal (EU) | Freshfields Bruckhaus Deringer | SPG-LEG-2025-012 | +49 30 20 28 39 000 | Partner-level response within 2 hours |\n| External Legal (US) | Covington & Burling | SPG-LEG-2025-013 | +1 202 662 6000 | Partner-level response within 2 hours |\n| Credit Monitoring | Experian IdentityWorks | SPG-EXP-2025-003 | +44 115 941 0888 | Portal activation within 48 hours |\n| Crisis Communications | Brunswick Group | SPG-COM-2025-001 | +49 69 2400 5510 | Team mobilized within 4 hours |\n| Cyber Insurance | Allianz Cyber Enterprise | SPG-CYB-2025-001 | +49 89 3800 0 | Claims acknowledgment within 24 hours |\n| eDiscovery \u002F Legal Hold | Relativity \u002F Exterro | SPG-LIT-2025-004 | +1 312 263 1333 | Legal hold activation within 4 hours |\n\n## Playbook Maintenance\n\n| Activity | Frequency | Owner |\n|----------|-----------|-------|\n| Review and update contact information | Quarterly | DPO Office |\n| Verify vendor retainer agreements are current | Annually | Procurement + DPO |\n| Update regulatory authority contact details | Semi-annually | DPO Office |\n| Tabletop exercise using playbook | Semi-annually | DPO + CISO |\n| Full playbook revision | Annually or after any SEV-1\u002FSEV-2 incident | DPO |\n| Distribute updated playbook to Core Response Team | After every revision | DPO Office |\n","# Building Breach Response Team Playbook\n\n## Overview\n\nA breach response team playbook is the operational manual that enables rapid, coordinated response when a personal data breach occurs. It pre-defines roles and responsibilities, escalation paths, communication templates, and external contact information so that the response team can act immediately without spending critical hours on logistics during an actual incident.\n\n## Team Structure — CSIRT + Privacy Integration\n\n### Core Response Team\n\n| Role | Primary | Backup | Contact | Responsibility |\n|------|---------|--------|---------|---------------|\n| Incident Commander (IC) | Thomas Brenner (CISO) | Marcus Weber (SOC Lead) | +49 30 7742 8100 \u002F ic@stellarpayments.eu | Overall coordination, resource allocation, containment decisions |\n| Data Protection Officer | Dr. Elena Vasquez | Anna Schmidt (Deputy DPO) | +49 30 7742 8001 \u002F dpo@stellarpayments.eu | Notification decisions, risk assessment, regulatory liaison, data subject communication |\n| Legal Counsel | Sarah Chen (General Counsel) | External: Dr. Klaus Fischer (Freshfields) | +49 30 7742 8200 \u002F legal@stellarpayments.eu | Legal advice, privilege management, regulatory strategy, law enforcement coordination |\n| IT Forensics Lead | Petra Hoffmann (IT Director) | External: Sarah Mitchell (Mandiant) | +49 30 7742 8300 \u002F it-forensics@stellarpayments.eu | Evidence preservation, forensic investigation, scope determination, root cause analysis |\n| Communications Lead | Martin Keller (Comms Director) | Lisa Braun (Senior Comms Manager) | +49 30 7742 8400 \u002F comms@stellarpayments.eu | Media response, customer communication, internal communication, social media monitoring |\n| Executive Sponsor | Marcus Lindqvist (CEO) | CFO: Dr. Andrea Hoffmann | +49 30 7742 8000 \u002F ceo@stellarpayments.eu | Strategic decisions, board notification, public statements, regulatory engagement |\n| Customer Relations | James Park (VP Customer Success) | Maria Santos (Customer Success Director) | +49 30 7742 5000 \u002F customers@stellarpayments.eu | Customer inquiry management, B2B client communication, service status updates |\n| HR Lead | Claudia Richter (CHRO) | Stefan Müller (HR Director) | +49 30 7742 7500 \u002F hr-confidential@stellarpayments.eu | Employee communication, Works Council coordination, insider threat scenarios |\n\n### Extended Team (Activated as Needed)\n\n| Role | Contact | Activation Trigger |\n|------|---------|-------------------|\n| Board Liaison | Board Secretary (Dr. Friedrich Weber) | Breach affecting 10,000+ data subjects or likely to result in high risk |\n| Cyber Insurance | Allianz Claims: +49 89 3800 0 (ref: SPG-CYB-2025-001) | Any breach likely to exceed EUR 50,000 in response costs |\n| External IR Firm | Mandiant: +1 703 935 1700 (retainer: SPG-IR-2025-007) | Any breach requiring forensic investigation beyond SOC capability |\n| External Legal | Freshfields: +49 30 20 28 39 000 (ref: SPG-LEG-2025-012) | Breach involving regulatory risk, litigation risk, or cross-border notification |\n| External Communications | Brunswick Group: +49 69 2400 5510 | Breach with media exposure or affecting 50,000+ individuals |\n| Credit Monitoring Vendor | Experian Enterprise: +44 115 941 0888 (retainer: SPG-EXP-2025-003) | Breach involving financial data, government IDs, or health data |\n\n## Escalation Matrix\n\n### Severity Classification\n\n| Severity | Criteria | Response Time | Escalation Level |\n|----------|----------|---------------|-----------------|\n| SEV-1 (Critical) | 10,000+ data subjects; special category data (Art. 9); ongoing exfiltration; ransomware with encryption | Immediate (within 15 minutes) | IC + DPO + CEO + General Counsel |\n| SEV-2 (High) | 1,000-10,000 data subjects; financial data; credentials; media exposure | Within 30 minutes | IC + DPO + General Counsel |\n| SEV-3 (Medium) | 100-1,000 data subjects; non-sensitive personal data; contained breach | Within 2 hours | IC + DPO |\n| SEV-4 (Low) | Under 100 data subjects; low-sensitivity data; contained with no exfiltration | Within 4 hours | SOC Lead + Privacy Coordinator |\n\n### Escalation Flow\n\n```\nSOC Analyst detects alert\n    ↓\nSOC Lead validates (within 15 min)\n    ↓\nPersonal data involved? → No → Standard security incident process\n    ↓ Yes\nClassify severity (SEV-1 to SEV-4)\n    ↓\nSEV-1\u002F2: Activate Incident Commander + DPO immediately\nSEV-3: Notify IC + DPO within 2 hours\nSEV-4: Notify Privacy Coordinator within 4 hours\n    ↓\nIC convenes Core Response Team\n    ↓\n72-hour Art. 33 clock determination\n    ↓\nInvestigation → Risk Assessment → Notification Decision\n```\n\n## Communication Templates\n\n### Template 1: Internal Breach Alert (Email to Core Response Team)\n\n**Subject: [SEV-X] PERSONAL DATA BREACH — Immediate Action Required**\n\n**From**: SOC \u002F Incident Commander\n**To**: Core Response Team distribution list\n\nA personal data breach has been identified requiring immediate response.\n\n**Incident Summary:**\n- Discovery time: [UTC timestamp]\n- Affected system(s): [system names]\n- Breach type: [Confidentiality \u002F Integrity \u002F Availability]\n- Estimated data subjects: [count or range]\n- Personal data categories: [list]\n- Containment status: [Contained \u002F Active \u002F Unknown]\n\n**Immediate Actions Required:**\n- IC: Convene response team call at [time] on [bridge\u002FTeams link]\n- DPO: Begin risk assessment; determine 72-hour deadline\n- IT Forensics: Preserve evidence on affected systems\n- Legal: Review for privilege and law enforcement considerations\n- Communications: Prepare holding statement; monitor media\n\n**Response Team Bridge**: [Teams meeting link]\n**Incident Channel**: Signal group \"SPG-IR-Active\"\n\n### Template 2: Media Holding Statement\n\nStellar Payments Group is aware of a security incident affecting [some of our systems \u002F our customer database]. We immediately activated our incident response procedures and are working with leading cybersecurity experts to investigate the matter. The protection of our customers' data is our highest priority. We will provide further information as our investigation progresses. For media inquiries, please contact press@stellarpayments.eu.\n\n### Template 3: Customer Service Talking Points\n\n**For customer-facing staff during an active breach:**\n\nIf a customer asks about a security incident:\n- \"We are aware of a security issue and our team is actively working to resolve it.\"\n- \"The security of your information is our top priority.\"\n- \"We will communicate directly with any affected customers as soon as our investigation allows.\"\n- \"I can take your contact details and ensure you are notified if your account is affected.\"\n\nDo NOT:\n- Confirm or deny specific details of the breach\n- Speculate on the number of affected customers\n- Provide information not in the approved talking points\n- Discuss the incident on social media\n\n### Template 4: Board Notification (Email to Board Chair)\n\n**Subject: Data Breach Notification to the Board — [Breach Reference]**\n\nDear [Board Chair],\n\nI am writing to inform you of a personal data breach that occurred on [date]. This notification is provided in accordance with our Board-approved Incident Escalation Policy.\n\n**Summary**: [2-3 sentence description]\n**Scale**: [approximate data subjects and data categories]\n**Status**: [contained\u002Funder investigation]\n**Regulatory notification**: [filed\u002Fpending\u002Fnot required]\n**Financial exposure**: [estimated response costs and potential regulatory penalties]\n\nA full briefing will be provided at [scheduled time]. In the interim, [CEO name] is overseeing the organizational response.\n\n### Template 5: Employee Communication (All-Staff)\n\n**Subject: Important Update from [CEO] Regarding a Security Incident**\n\nDear Colleagues,\n\nI want to share an important update. On [date], we identified a security incident affecting [description]. Our security and privacy teams are working around the clock to investigate and resolve the situation.\n\n**What we know**: [brief, factual description]\n**What we are doing**: [containment and investigation actions]\n**What this means for you**: [if employee data was involved, say so directly; if not, clarify]\n**What we ask of you**: Report any unusual system activity to security@stellarpayments.eu. Do not discuss this matter externally or on social media.\n\nWe will provide updates as we learn more. Thank you for your professionalism and support during this time.\n\n[CEO Name]\n\n## Regulatory Authority Contact Directory\n\n### European Union\n\n| Country | Authority | Breach Portal \u002F Contact | Phone |\n|---------|-----------|------------------------|-------|\n| Germany (Berlin) | Berliner BfDI | datenschutz-berlin.de | +49 30 13889 0 |\n| Germany (Federal) | BfDI | bfdi.bund.de | +49 228 997799 0 |\n| France | CNIL | notifications.cnil.fr\u002Fnotifications | +33 1 53 73 22 22 |\n| Ireland | DPC | forms.dataprotection.ie | +353 57 868 4800 |\n| Netherlands | AP | autoriteitpersoonsgegevens.nl | +31 70 888 8500 |\n| Spain | AEPD | sedeagpd.gob.es | +34 91 266 35 17 |\n| Italy | Garante | protocollo@pec.gpdp.it | +39 06 696 77 1 |\n| Belgium | APD\u002FGBA | gegevensbeschermingsautoriteit.be | +32 2 274 48 00 |\n| Austria | DSB | dsb.gv.at | +43 1 52 152 0 |\n| Poland | UODO | uodo.gov.pl | +48 22 531 03 00 |\n\n### United Kingdom\n\n| Authority | Portal | Phone |\n|-----------|--------|-------|\n| ICO | ico.org.uk\u002Ffor-organisations\u002Freport-a-breach | +44 303 123 1113 |\n\n### United States\n\n| Authority | Portal | Phone |\n|-----------|--------|-------|\n| HHS\u002FOCR (HIPAA) | ocrportal.hhs.gov | +1 800 368 1019 |\n| California AG | oag.ca.gov\u002Fprivacy\u002Fdatabreach\u002Freporting | +1 916 210 6276 |\n| New York AG | ag.ny.gov\u002Finternet\u002Ffiling-a-complaint | +1 800 771 7755 |\n| FTC | ftc.gov\u002Fenforcement | +1 877 382 4357 |\n\n### Other International\n\n| Jurisdiction | Authority | Contact |\n|-------------|-----------|---------|\n| Canada | OPC | priv.gc.ca | +1 819 994 5444 |\n| Australia | OAIC | oaic.gov.au\u002Fprivacy\u002Fnotifiable-data-breaches | +1300 363 992 |\n| Brazil | ANPD | gov.br\u002Fanpd | +55 61 2025 8900 |\n| Singapore | PDPC | pdpc.gov.sg | +65 6377 3131 |\n\n## Pre-Negotiated Vendor Contacts\n\n| Service | Vendor | Contract Reference | Activation Contact | SLA |\n|---------|--------|-------------------|-------------------|-----|\n| Incident Response | Mandiant | SPG-IR-2025-007 | +1 703 935 1700 \u002F ir@mandiant.com | On-site within 24 hours, remote within 4 hours |\n| External Legal (EU) | Freshfields Bruckhaus Deringer | SPG-LEG-2025-012 | +49 30 20 28 39 000 | Partner-level response within 2 hours |\n| External Legal (US) | Covington & Burling | SPG-LEG-2025-013 | +1 202 662 6000 | Partner-level response within 2 hours |\n| Credit Monitoring | Experian IdentityWorks | SPG-EXP-2025-003 | +44 115 941 0888 | Portal activation within 48 hours |\n| Crisis Communications | Brunswick Group | SPG-COM-2025-001 | +49 69 2400 5510 | Team mobilized within 4 hours |\n| Cyber Insurance | Allianz Cyber Enterprise | SPG-CYB-2025-001 | +49 89 3800 0 | Claims acknowledgment within 24 hours |\n| eDiscovery \u002F Legal Hold | Relativity \u002F Exterro | SPG-LIT-2025-004 | +1 312 263 1333 | Legal hold activation within 4 hours |\n\n## Playbook Maintenance\n\n| Activity | Frequency | Owner |\n|----------|-----------|-------|\n| Review and update contact information | Quarterly | DPO Office |\n| Verify vendor retainer agreements are current | Annually | Procurement + DPO |\n| Update regulatory authority contact details | Semi-annually | DPO Office |\n| Tabletop exercise using playbook | Semi-annually | DPO + CISO |\n| Full playbook revision | Annually or after any SEV-1\u002FSEV-2 incident | DPO |\n| Distribute updated playbook to Core Response Team | After every revision | DPO Office |\n",{"name":5,"license":15,"metadata":40,"description":7},{"tags":41,"author":9,"domain":29,"version":42,"subdomain":43},"breach-playbook, csirt, incident-response-team, escalation-matrix, communication-templates","1.0","data-breach-response","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fbreach-response-playbook",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-response-playbook",{"tool":59,"command":60},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-response-playbook",{"tool":62,"command":63},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill breach-response-playbook","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002FSKILL.md",true,[67,73,79,83],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md","ASSET","资产文件",2328,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fstandards.md","REFERENCE","参考文档",2170,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002Freferences\u002Fstandards.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fworkflows.md",2519,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002Freferences\u002Fworkflows.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fprocess.py","SCRIPT","脚本",9222,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fbreach-response-playbook\u002Fscripts\u002Fprocess.py",[90,114,131,144,161,174],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":105,"publishedAt":35},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[96,101,104],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[106,107,29,108,109,32,110,111,112,113],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":124,"publishedAt":35},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[120,123],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[32,125,126,127,108,128,129,29,130],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":35},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[137],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[32,139,140,141,142,129,29,143],"vendor termination data","planning","verification","extraction","certification",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":151,"publishedAt":35},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[150],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[152,153,154,155,156,157,158,159,29,32,160],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":35},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[167],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[29,169,129,170,157,171,172,32,160,153,143,173],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":187,"publishedAt":35},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[180,183,186],{"categoryNo":181,"categoryName":182,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,29,190,141,191,108,129,192,160,193,194,195,140],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]