We help you build procedures that reflect the requirements that apply to you, and apply them to each incident.
For the jurisdiction-specific position, see
Privacy Services
Privacy Breach & Incident Response Services
We help organizations prepare for privacy incidents and respond through a structured process. Our work covers response planning, breach assessment, notification support, documentation and corrective actions, working alongside legal counsel and technical specialists where required.
Coverage: Response Plans · Breach Assessment · Notification Coordination · Incident Registers · Tabletop Exercises · Post-Incident Review
Our Capabilities
Structured Support Before, During and After an Incident
Privacy incidents move quickly, and the decisions made in the first days are often reviewed later by regulators, customers and insurers. We build the process that makes those decisions deliberate and well documented.
Develop response plans, decision trees and role assignments so your team knows who does what, who decides and who must be told.
Capability 01 / 06
6moments when incident support helps
When to Engage
Before and After an Incident
Building a Response Capability
You have no documented process for privacy incidents, or the one you have has never been tested.
Responding to a Suspected Breach
Personal information may have been lost, accessed or disclosed without authorization, and you need to assess what happened and what follows.
Assessing Whether to Notify
You need a structured, documented way to reach a notification decision.
Receiving a Customer or Regulator Inquiry
A client, partner or regulator asks about an incident or about your readiness to handle one.
After a Vendor Incident
A third party that handles your personal information reports a breach that may affect you.
Learning From an Incident
An incident has been contained and you want to understand what went wrong, close the gaps and update your procedures.
What You Can Expect
Prepared Procedures and Documented Incident Decisions
Depending on the agreed scope, deliverables may include:
- 01
Incident Response Plan & Playbooks
Roles, escalation paths, decision trees and communication steps.
- 02
Breach Assessment Records
Documented facts, the information and individuals involved and the harm analysis.
- 03
Notification Decision Documentation
The reasoning behind each notification decision and who made it.
- 04
Notification Drafts & Coordination Support
Prepared communications for the parties you decide to notify, for your review and approval.
- 05
Incident Register
A record of incidents, assessments, decisions and outcomes.
- 06
Tabletop Exercise Report
Scenario, observations and recommended improvements.
- 07
Corrective-Action Plan
Recommended improvements based on available investigation findings, with prioritized actions, owners and milestones.
- 08
Post-Incident Review
Documented lessons learned and recommendations for updating procedures, controls and training.
The aim is a response your team can follow under pressure, and a record that shows how each incident was handled.
Discuss Your Requirements
Regulatory Alignment
Notification Requirements Differ by Law and Circumstance
Whether an incident must be reported, to whom and by when depends on the laws that apply, the type of information involved, the risk it creates and any contractual commitments. Requirements differ between Canadian federal and provincial law, U.S. state and sector laws and GDPR, and also between customer contracts.
Working With Other Advisers
Serious incidents usually involve more than privacy. Legal counsel advises on obligations and liability, forensic specialists investigate the technical cause, and insurers may need early notice. We coordinate with those advisers and don’t replace them.
For incidents that start with a vendor, see
For governance and training around incident readiness, see
Our Approach
From Triage to Lasting Improvement
- STEP 01
Triage
Establish what happened, what personal information is involved and what has been contained, in coordination with technical and legal advisers.
- STEP 02
Assess
Evaluate the risk to individuals and analyze notification obligations under the requirements that apply.
- STEP 03
Coordinate
Support required notifications, where applicable, and document available facts, decisions, approvals and communications.
- STEP 04
Improve
Review available investigation findings, recommend corrective actions and support updates to incident plans, procedures and training.
Get In Touch
Prepare for an Incident, or Work Through One
Tell us whether you are building readiness or dealing with an incident now. We will review the relevant requirements and discuss an appropriate engagement scope.
FAQs
Frequently Asked Questions
It depends on the laws that apply, the information involved, the risk the incident creates and any contractual obligations. We help structure that assessment and document the decision. Where a formal legal determination is needed, it should come from qualified legal counsel.
Yes, we can support assessment, documentation and notification coordination. Because incidents are time-sensitive, contact us as early as possible. We recommend involving legal counsel and, where appropriate, forensic specialists at the same time.
No. Forensic investigation is a specialist technical service, and we coordinate with the specialists you engage. Our role is the privacy side: assessment, decisions, notification and documentation.
No. We coordinate with your counsel and your insurer, and we don’t give legal opinions. Policies often set their own notice requirements, so check yours early.
A facilitated simulation of an incident, in which your team works through its response plan under a realistic scenario. It shows where roles, decisions and communications need to be clearer, before a real event.
Yes. A response plan, a tabletop exercise or a post-incident review can be scoped as a defined project, separate from a broader program engagement.
Related Services
Explore More Ways We Can Help
Privacy Program Development & Governance
Governance frameworks, policies, data inventories, consent processes and staff training.
Learn MorePrivacy Impact Assessments, DPIAs & AI Risk
PIAs, GDPR DPIAs and AI risk reviews before a product, system or vendor goes live.
Learn MoreCanada Privacy Compliance
PIPEDA, Quebec Law 25, provincial privacy laws and CASL compliance.
Learn More