- Detect & triage (T+0–2 h): confirm personal data involved; open incident channel; freeze evidence (BetterStack export, audit_log extract by correlation_id); classify scope (tenants, contacts, fields — was national_id exposed?).
- Contain (T+2–12 h): revoke exposed keys/tokens; rotate secrets; patch vector; if exfiltration via webhook/integration, disable endpoint; snapshot DB state.
- Assess (T+12–36 h): count affected data subjects per tenant; risk level (sensitive fields ⇒ high); document in incident record (template in Comply).
- Notify controllers (tenants) (T+≤48 h): per DPA obligation “without undue delay”: affected counts, fields, measures, recommendations. Template: 70-legal annex.
- Notify APDP (T+≤72 h): via Agency channel; DPO signs. If high risk: plan data-subject notification WITH the affected tenants (they are controllers; we assist).
- Remediate & verify (T+≤7 d): fix root cause; add regression test; verify no recurrence in logs.
- Post-mortem (T+≤14 d): blameless doc; update RAT/DPIA if processing changed; file evidence pack (the APDP audits operational evidence). Quarterly: tabletop drill; keep contact sheet current (APDP, lawyer, hosting DPO contacts).
Runbook — Personal Data Breach (72 h) — BLOCKING before commercial launch
Roles: Incident Lead (DPO — Daniel, provisional) · Tech Lead · Comms. Clock starts at DETECTION (log timestamp).
Refs: DEC-J4, Ley 21.719 (notification to APDP without undue delay; 72 h target; affected data subjects if high risk)
⌘I