Data Breach Notification Procedure by Country

How to use this document

• Use it to decide, in the first hours of a security breach affecting personal data, whom to notify, by when and with what content in each country where the organization operates, including breaches that originate in an AI system or an AI vendor.
• It extends the AI incident response plan: the plan handles technical containment; this procedure handles notifications and the proof that they were made.
• Suggested owners: the chief information security officer (CISO) for detection and containment, and the data protection officer (DPO) or privacy function for assessment and notifications.
• Before adopting it, decide who may sign and send a notification to an authority, who approves messages to affected people and which risk threshold triggers notification where the law leaves room for judgment.
• Complete the contact table in section 3, the country table in section 7 and the [COMPLETE] fields in the templates in section 8.
• Keep in "Country variants" only the jurisdictions where you process personal data or have affected people. A single breach can trigger several variants at once.
• Deadlines shown without [COMPLETE] are those that, according to the sources reviewed as of this version's date, the cited rules set; confirm them with your advisor as well. The others are left open for you to confirm with your advisor before approving the document, because they change often or depend on the sector.
• Ask internal legal or an outside advisor to review the procedure and templates, especially sector-specific deadlines (banking, insurance, health care, telecommunications, essential services).
• Approve it in the [AI COMMITTEE] or the body that oversees security, share it with the response team and test it with a drill before treating it as implemented.

Data Breach Notification Procedure by Country

Field	Content
Organization	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
Procedure owner	[OWNER]
Function	[RESPONSIBLE FUNCTION]
Countries covered	[COUNTRY]
Privacy contact	[PRIVACY EMAIL]
Related document	AI Incident Response Plan
Version and date	1.0.0 / [DATE]

1. Purpose and scope

1.1. [ORGANIZATION NAME] adopts this procedure to assess, notify and document security breaches affecting personal data for which it acts as controller or processor, in every country where it operates.

1.2. It applies to any breach, whatever its source: internal systems, the organization's own or third-party AI systems, vendors and processors, devices, paper records and human error.

1.3. It expressly covers AI-related breaches, for example:

• personal data entered into an unauthorized AI tool, or one configured to reuse the data;
• data leaks through malicious instructions (prompt injection) or through model outputs;
• exposure of training, fine-tuning or evaluation datasets;
• connectors, agents or integrations that access repositories with excessive permissions;
• breaches suffered by an AI vendor that processes data on the organization's behalf;
• extraction of personal data memorized by a model.

1.4. This procedure does not replace sector-specific duties (banking, insurance, health care, telecommunications, essential services, securities markets) or contractual commitments to customers. These are listed in the table in section 7 when known.

2. Definitions

• Personal data breach: a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. It includes loss of availability.
• Cybersecurity incident: an event that compromises the confidentiality, integrity or availability of networks, systems or information, even if no personal data is affected.
• Time of awareness: the date and time when the organization has a reasonable degree of certainty that a security incident affecting personal data has occurred. Deadlines run from that moment.
• Authority: the data protection authority, national computer security incident response team (CSIRT) or sector regulator that must receive the notification.
• Affected people: the individuals whose data was compromised.
• Processor or vendor: a third party that processes personal data on the organization's behalf, including AI service vendors.