---
title: "Draft a data-breach incident response plan"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan"
type: "task"
site: "AI Law Framework"
id: "A25-T1-R4"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Draft a data-breach incident response plan

> Produce a plan covering detection, containment, assessment, notification and post-incident review, with a RACI and template notices.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Produce a plan covering detection, containment, assessment, notification and post-incident review, with a RACI and template notices. |
| What the lawyer must review | Align the plan to every reporting stream that applies Include the privacy regulator, cyber authority, insurers and sector rules Do not rely on one 30-day clock |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Lawyer review required**

The responsible lawyer reviews the work against the instructions, sources and intended use.

- What the AI does: Potential support includes preparing preliminary structure or wording and identifying points for review. Confirm the tool’s capability and permitted scope.
- What the lawyer does: Set the scope, verify the evidence, resolve exceptions and approve the final output for its intended use.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Suggested checking approach based on the task guidance. Complete the assessment for the actual tool, information and jurisdiction.
- Why: The plan reflects the described work and review requirements. Policy colours are not used to determine permission or checking.

## Checks the lawyer makes

1. Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
2. Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
3. Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
4. Review the original source set for relevant material absent from the output, including contrary evidence, qualifications and unresolved gaps.
5. Preserve original files and relevant metadata. Document provenance and handling, and seek forensic review where authenticity needs to be resolved.
6. Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
7. Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.

## Notes

- Confirm the required checking with the responsible lawyer before work starts. The checking approach does not establish permission to use AI.

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Incident response plan outline](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-incident-response-plan.md) | Checklist | Yellow | An outline for a written incident response plan, arranged on the six functions in NIST SP 800-61r3. A Safeguards Rule plan is a separate box, and only if that rule applies. |
| [California security breach notice](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-california-breach-notice.md) | Notice | Yellow | Notice to a California resident under Civil Code § 1798.82, using the statutory title and headings. It leaves the facts in brackets.… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-breach-incident-response-plan/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*