Assess a suspected data breach and draft the notification pack
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- The statement to the regulator and the notice to individuals are the lawyer's to write and the tool writes no part of either. Organise the incident record into a source-referenced assessment table — what was accessed, whose information and which systems, every row referenced to the document or log it comes from and set beside the statutory serious-harm factors with a column for each factor — and list the facts that still need a source, the notification route chosen, and whether any other entity is being treated as covered by this notification. Check the lawyer's own statement against each prescribed content item and the regulator's notification form, compare the notice to individuals against that statement and flag anything the statement says that the notice does not carry, and flag anything the drafts assert that the incident record does not support, or that the two drafts say differently.
- What the lawyer must review
- Decide whether the incident is notifiable under the current statute. Deadlines and 'serious harm' are lawyer calls, and so are the notification route and whether any other entity is covered by this notification. The lawyer writes the statement to the regulator and the notice to individuals, and confirms every fact and every remediation step asserted in them is true at the moment of issue.
Open a jurisdiction version of this task to see which instruments apply.
Who does what
| Role | What they do |
|---|---|
| Assistance | Supporting preparation only. Potential support includes organising research leads and preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. Substantive advice, judgement and any restricted content remain with the responsible human. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.