{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:b6d82ac360dbc52b9d28da072da02bf71b207adfa96d8d8119353ae4692a80e4","slug":"reg-privacy-breach-notification","url":"/assets/agent_workflow-reg-privacy-breach-notification-7510827d.0b3a593e95171fd2.json"},"kind":"record","record":{"attributes":{"department":"privacy","domain":"reg","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=reg-privacy-breach-notification","description":"Personal-data breach response, anchored on a breach-register Issue item created for the breach (issue_type: exception, source: management_identified, identified_date = the awareness timestamp); the workflow instance attaches to that Issue and the breach register is the queryable set of these Issues. Consumes the Incident Management Lifecycle workflow's handoff package (incident record, containment status, investigation timeline) and drives it from handoff to closure: a frozen, dated exposure inventory; a per-jurisdiction notifiability determination against GDPR Article 33, US state (California/CCPA included), and HIPAA clocks; regulator and data-subject notifications with milestone tracking; processor coordination against the processor's Vendor record and DPA; remediation and support Issue items; the Article 33(5) breach-register entry; and a post-breach review that hands off to the DPIA / Privacy Impact Assessment workflow for each affected processing activity. In scope: the notifiability judgment and notification execution downstream of the incident handoff; out of scope: incident containment and forensics, which stay with incident response.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=reg-privacy-breach-notification","capabilities":[],"controls":["UC-IR-05","UC-IR-08","UC-IR-10","UC-LOG-06","UC-DATA-15","UC-DATA-16"],"domains":["reg"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:b6d82ac360dbc52b9d28da072da02bf71b207adfa96d8d8119353ae4692a80e4","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:reg-privacy-breach-notification","standards":["gdpr","hipaa","ccpa"],"teams":["privacy","it"]},"id":"wf:R16","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AR16","slug":"reg-privacy-breach-notification","sourceIds":["coso-ic","gdpr","hipaa","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Privacy Breach Assessment & Notification","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3ec7830226564cce898cf4cbabf8594d2f81ae8cebd37edcebb14811db6b60c9","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-ir-08-01afe3d1.json","targetId":"uc:UC-IR-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:60030743a8cc801e5e01ec5b6a9070ed8fa2e653c9ea466db24e10e4c8ef9cea","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-log-06-735bbc3e.json","targetId":"uc:UC-LOG-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:94b21ae83f86a03a5515a9e49098b83b15a5662084be5ea8d7c71f45f6d20454","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-data-16-57ae2c9a.json","targetId":"uc:UC-DATA-16","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c863f809727b948f7005323519f04b234962ef722fdceddcbf1a11381b27821b","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","targetId":"uc:UC-IR-05","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eeea4e843090f7187b9626c9714d0140d2b1ae180d173087a55f404f17764bf6","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-ir-10-072c0403.json","targetId":"uc:UC-IR-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff537bc4838d7c3c20a6ddb8014c3efb74a119492954c6cfd3b245088e5f3265","properties":{},"sourceDetailPath":"/data/v1/records/wf-r16-5b93e206.json","sourceId":"wf:R16","targetDetailPath":"/data/v1/records/uc-uc-data-15-efb7b99a.json","targetId":"uc:UC-DATA-15","type":"operates"}],"schemaVersion":1}