Responding to a Data Breach and Exercising Privacy Rights: A Practical Checklist

Technology > Data Privacy and Security | Published 26 July 2026 - Updated 14 August 2026 | UpLaw - uplaw.us

⚠ Businesses: do not wipe or rebuild before imaging, and engage counsel before the forensic firm. ⭐ Individuals: freeze your credit. It is free, reversible, and it prevents fraud rather than reporting it afterward.

Use with Data Privacy and Security: A Comprehensive Guide to Collection, Consent, Breach Response, and Enforcement and The Data Privacy and Breach Response Toolkit.

---

PART ONE — THE BUSINESS

Phase 1 — Hour zero

☐ Contain. Isolate affected systems, revoke compromised credentials, rotate keys, block the vector. ☐ ⚠ ⭐ PRESERVE BEFORE YOU FIX. Image affected systems, capture memory, and freeze logs before rebuilding. ⚠ The single most common irreversible error in incident response is wiping a machine to restore service. See Issuing a Litigation Hold and Preserving ESI: A Practical Checklist. ☐ Suspend log rotation on every relevant system. ☐ ⭐ Engage counsel first, then retain the forensic firm through counsel, so the investigation is directed by counsel. ☐ Notify the cyber insurer. ⚠ Policies frequently require prompt notice and use of panel vendors; using your own firm first can forfeit coverage. ☐ Convene the response team — legal, security, IT, communications, executive sponsor — and open one decision log. ☐ ⚠ Say nothing publicly yet.

---

Phase 2 — Days one through seven: scoping

☐ Determine what happened: vector, timeline of access, systems reached, whether data was exfiltrated or only accessible. ☐ ⭐ Determine WHAT DATA. ⚠ This is where responses stall. A current data map answers it in hours; its absence turns a two-week response into a two-month one. ☐ Identify the data elements against each state's definition: name plus Social Security number · driver's license or state ID number · financial account with access code · medical or health insurance information · biometric data · username with password · precise geolocation. ☐ ⭐ Apply the encryption safe harbor. Most statutes exempt encrypted data unless the key was also compromised. Document the encryption status of each element. ☐ Identify affected individuals and their states of residence. ⚠ Residence, not where your business is. ☐ Identify sector overlays: HIPAA breach rules for covered entities and business associates · financial regulator requirements · securities disclosure for public companies · government contract clauses. ☐ Identify contractual deadlines. ⚠ Customer and partner contracts frequently require notice within twenty-four to seventy-two hours — far shorter than any statute. ☐ Run the risk-of-harm analysis where the state permits it, and ⭐ document the determination; several states require it be retained or reported. ☐ ⚠ Resist premature conclusions. ⭐ A public statement that later proves wrong is its own enforcement exposure.

---

Phase 3 — Notification

☐ Compute the shortest applicable deadline across every state, sector rule, and contract. ☐ Draft the individual notice, containing:

• ☐ What happened, and when
• ☐ The categories of information involved
• ☐ What the business has done
• ☐ ⭐ What the individual should do — with the credit freeze first, not credit monitoring first
• ☐ Contact information for questions
• ☐ ⚠ State-specific required content and toll-free numbers ☐ Have counsel review it against each affected state's content requirements. ☐ ⚠ Do not overstate or understate. ⭐ Notices that minimize become enforcement exhibits. ☐ Send by the method the statute requires — written notice, email where the individual consented, or substitute notice where thresholds are met. ☐ Notify the state attorney general above each state's threshold, in the required format. ☐ Notify the consumer reporting agencies above the threshold. ☐ Notify sector regulators — including, for HIPAA breaches, individuals within sixty days, prominent media where five hundred or more residents of a state are affected, and the Secretary immediately or annually depending on size. ☐ Stand up a call center and a website posting before the notices land. ☐ Offer credit monitoring or identity restoration where required or warranted — ⚠ knowing it detects rather than prevents.

---

Phase 4 — After the notices

☐ Remediate the root cause, and document what was changed and when. ☐ Reset credentials broadly, not just for the compromised accounts. ☐ Review vendor obligations if a processor was the source — ⚠ indemnity, cost allocation, and whether they met their contractual notice deadline. ☐ Prepare for regulator inquiry. ⭐ Expect a request for the forensic report, the data map, the security program, the incident timeline, and the risk determination. ☐ Prepare for litigation — preserve everything, and expect class claims where a statute supplies damages. ☐ ⭐ Conduct a documented post-incident review. ⚠ Its absence is itself an examination finding, and it is the cheapest item on this list. ☐ Update the incident response plan with what actually failed. ☐ Re-run the tabletop within ninety days.

---

Phase 5 — Vendor breaches

☐ Get written confirmation of what the vendor knows: systems, timeline, data elements, and individuals affected. ☐ ⚠ Do not accept "we are investigating" for weeks. ⭐ Your statutory clock may run from when you should have known. ☐ Demand the forensic report, or at minimum a detailed factual summary. ☐ Determine who notifies. ⚠ In most state statutes the data owner notifies individuals and the processor notifies the owner — but contracts vary and both must be reconciled. ☐ Check the contract for notice deadlines, cooperation obligations, indemnity, and cost allocation. ☐ Preserve your own logs showing the vendor's access. ☐ Assess whether to terminate, and whether deletion obligations were met.

---

PART TWO — THE INDIVIDUAL

Phase 6 — You received a breach notice

☐ ⭐ Freeze your credit at all three bureaus. Free, reversible, and it prevents new-account fraud rather than reporting it — 15 U.S.C. § 1681. ☐ Place a fraud alert as well, and consider an extended alert if you are an identity theft victim. ☐ Change the password on the affected account and everywhere you reused it. ☐ Enable multi-factor authentication, preferring an app or hardware key over text messages. ☐ Read what was actually taken. ⭐ A Social Security number is a different problem from an email address, and the response should differ. ☐ If a Social Security number was taken: freeze credit, request your consumer report files, consider an identity protection PIN with the tax authority, and watch for unexpected mail about accounts you did not open. ☐ If financial account data was taken: contact the institution, request a new account number and card, and review statements. ⭐ Report unauthorized electronic transfers promptly — 15 U.S.C. § 1693 and the error resolution procedures at 15 U.S.C. § 1693f, implemented at 12 C.F.R. Part 1005. ⚠ Liability caps depend on how fast you report. ☐ If medical information was taken: request an accounting of disclosures under the HIPAA rules at 45 C.F.R. Part 164, and watch explanation-of-benefit statements for care you did not receive. ☐ Accept the offered monitoring — ⚠ but understand it detects rather than prevents, and it is not a substitute for a freeze. ☐ Keep the notice letter. ⭐ If misuse occurs later, it is your proof of the exposure. ☐ If you find fraudulent accounts: file a report with the federal identity theft site, file a police report, dispute with the furnisher and the bureau under 15 U.S.C. § 1681s-2, and request an identity theft block under 15 U.S.C. § 1681c-2. See Disputing a Credit Report Error and Defending a Debt Collection Suit: A Practical Checklist. ☐ ⚠ Understand your remedy is limited. In most states exposure alone will not support a lawsuit — claims succeed where there is documented misuse, a statutory damages provision, or a state-specific breach right of action.

---

Phase 7 — Exercising a privacy right

☐ Confirm your state has a comprehensive privacy statute and that the business is covered. ☐ Find the mechanism in the privacy notice — a web form, a toll-free number, or an email address. ⚠ A business that sells or shares data must also provide a conspicuous opt-out link. ☐ Choose the right you want:

• ☐ Access — what was collected, from what sources, for what purposes, and to which categories of third parties disclosed
• ☐ Correction
• ☐ Deletion
• ☐ Portability
• ☐ Opt out of sale
• ☐ Opt out of targeted advertising
• ☐ Opt out of profiling with legal or similarly significant effects
• ☐ ⭐ Limit use of sensitive data — precise location, health, biometric, and the other sensitive categories ☐ State the statute by name and the specific right. ☐ Expect identity verification. ⭐ This is required and legitimate — ⚠ but a business may not demand an unreasonable amount of new personal data to verify you. ☐ Note the deadline — commonly forty-five days, extendable once with notice. ☐ ⭐ Ask specifically for the categories of third parties to whom your data was disclosed. ⚠ This is frequently the most revealing thing a company will hand you, and it tells you which brokers to contact next. ☐ Understand what deletion does not reach: backups on their normal cycle · copies already sold or shared · de-identified or aggregated data · and information covered by an exception. ☐ Know the deletion exceptions: completing a transaction, providing a requested service, security incident detection, legal obligations, free speech, internal uses aligned with your expectations, and defense of legal claims. ⭐ A business that identifies the exception is complying, not stonewalling. ☐ Use the appeal process if the request is denied. ☐ ⚠ If ignored: in most states your remedy is a complaint to the attorney general, not a lawsuit. ⭐ File it anyway — enforcement is built from patterns. ☐ Keep the whole record — request, date, response, and deadline.

---

Phase 8 — Reducing exposure generally

☐ ⭐ Credit freeze at all three bureaus. The highest-return action available. ☐ Use your state's data broker deletion mechanism where one exists — ⭐ one submission, hundreds of brokers. ☐ Enable the universal opt-out signal in your browser. ☐ Audit app location permissions. ⭐ Precise location is the highest-value data most people give away, and most apps do not need it. ☐ Reset advertising identifiers periodically. ☐ Use a password manager so one breach is not every breach. ☐ Opt out of pre-screened credit and insurance offers — 15 U.S.C. § 1681b. ☐ Register on the do-not-call list — ⭐ 47 U.S.C. § 227 actually provides a private right of action with statutory damages, which is rare in this field. ☐ Review the sensitive-data settings on health, fitness, and genetic services — ⚠ the least regulated and most revealing category. ☐ Request and correct your consumer report files annually.

---

PART THREE — THE ONGOING WORK

Phase 9 — The compliance program that makes Part One survivable

☐ ⭐ Build and maintain a data map. Systems, data elements, sources, purposes, recipients, retention, and physical location. ⚠ Every failed breach response traces back to its absence. ☐ Run an applicability analysis:

• ☐ Sectoral — health under 45 C.F.R. Part 160 and 45 C.F.R. Part 164, with penalties at 42 U.S.C. § 1320d-6 · financial under 15 U.S.C. § 6801 and 15 U.S.C. § 6802 · children under 15 U.S.C. § 6501 and 15 U.S.C. § 6502 · education under 20 U.S.C. § 1232g · consumer reporting under 15 U.S.C. § 1681e and 15 U.S.C. § 1681m
• ☐ State comprehensive statutes by resident and revenue thresholds
• ☐ ⭐ The general backstop — 15 U.S.C. § 45 — which applies to everyone ☐ ⚠ Read the code before writing the notice. ⭐ The gap between the privacy policy and what the software actually does is the leading enforcement theory in this field. ☐ Inventory every analytics tag, pixel, and software development kit, and characterize each transfer — ⚠ many are "sales" or "sharing" under state definitions even where no money changes hands. ☐ Audit consent flows for dark patterns. ⭐ Is declining as easy as accepting? ☐ Build a rights request workflow with intake, authentication, search across every system, response, appeal, and logging. ☐ Honor universal opt-out signals. ☐ ⭐ Minimize and set retention schedules, enforced technically. ⚠ Indefinite retention converts every legacy system into a breach exposure. ☐ Encrypt at rest and in transit — ⭐ and remember the breach statute safe harbor. ☐ Fix the vendor contracts: purpose limits · security obligations · subprocessor controls · deletion on termination · ⭐ a breach notice deadline of twenty-four to seventy-two hours · audit rights · ⚠ and an express prohibition on using your data for the vendor's own purposes, including model training. ☐ Complete data protection assessments for targeted advertising, sale, profiling with significant effects, and sensitive data. ☐ Monitor communications compliance — ⚠ session replay and call recording implicate 18 U.S.C. § 2511 and stricter state all-party consent rules; provider disclosure implicates 18 U.S.C. § 2702. ☐ Check marketing compliance — 47 U.S.C. § 227 for calls and texts, 15 U.S.C. § 7701 for email. ☐ Rehearse the incident response plan at least annually. ☐ Train the people who touch data, and keep records. ☐ Track legislation. ⚠ A program built two years ago is out of date.

---

The mistakes that cost the most

⚠ Wiping or rebuilding before imaging. ⚠ Calling the forensic firm before counsel. ⚠ Making a public statement ahead of the investigation. ⚠ Having no data map, and therefore no ability to scope. ⚠ Missing a contractual notice deadline shorter than the statute. ⚠ A privacy notice that does not match the code. ⚠ An opt-out link that does not actually stop the transfer. ⚠ A vendor contract with no breach notification deadline. ⚠ Indefinite retention. ⚠ Unencrypted data at rest — forfeiting the safe harbor. ⚠ Consent flows with asymmetric accept and decline paths. ⚠ For individuals: accepting credit monitoring and skipping the freeze.

---

The first-hour card

⭐ Print this and post it where the on-call engineer will see it.

SUSPECTED DATA INCIDENT — FIRST HOUR

1. ⚠ DO NOT wipe, rebuild, reimage, or restore from backup yet.
2. ⚠ DO NOT delete logs. Suspend log rotation now.
3. Isolate the affected system from the network. Do not power it off if memory capture is possible.
4. Revoke compromised credentials and rotate keys.
5. Call: [counsel] → [security lead] → [executive sponsor] → [cyber insurer].
6. ⚠ Do NOT call the forensic firm directly. Counsel retains them.
7. ⚠ Do NOT email about the incident outside the response team, and do not speculate in writing.
8. ⚠ Do NOT post, tweet, or tell a customer anything yet.
9. Open the decision log. Time-stamp every action and who took it.
10. Start the data question: what data lived on that system?

---

The individual's one-page version

If you received a breach notice and want the short version:

☐ ⭐ Freeze your credit at all three bureaus. Today. It is free. ☐ Change the password on that account and everywhere you reused it. ☐ Turn on multi-factor authentication. ☐ Read what was actually taken — a Social Security number is a different problem from an email address. ☐ Keep the letter. ☐ Watch your statements for ninety days. ☐ ⚠ Do not assume the offered monitoring protects you. It reports; the freeze prevents.

⭐ That is the whole list. Everything else is optional.

---

Sector-specific supplements

If you are a HIPAA covered entity or business associate

☐ Apply the four-factor risk assessment: the nature and extent of the information · the unauthorized person who used or received it · whether it was actually acquired or viewed · and the extent to which the risk has been mitigated. ⚠ The presumption is that an impermissible use or disclosure IS a breach unless the assessment shows a low probability of compromise. ☐ Notify individuals within sixty days of discovery. ☐ Notify prominent media where five hundred or more residents of a state are affected. ☐ Notify the Secretary — immediately for breaches of five hundred or more, annually otherwise. ☐ Business associates notify the covered entity — ⚠ check the business associate agreement, which frequently requires far faster notice than the regulation. ☐ Document everything, including a determination that no breach occurred. ☐ ⚠ Remember the criminal exposure at 42 U.S.C. § 1320d-6 for knowing wrongful disclosure.

If you are a financial institution

☐ Apply the safeguards program obligations under the 15 U.S.C. § 6801 framework. ☐ Check regulator-specific notification timelines, several of which are measured in hours. ☐ Assess whether customer notice is required and in what form. ☐ Consider 15 U.S.C. § 6802 implications if information was shared with nonaffiliated parties.

If children's data was involved

☐ ⚠ 15 U.S.C. § 6502 obligations attach where the service is child-directed or you had actual knowledge. ☐ Notify parents, not only account holders. ☐ ⭐ Expect heightened regulator attention. Children's data is a stated enforcement priority nearly everywhere.

If employee data was involved

☐ ⚠ Several state privacy statutes exclude employee data, so the breach statutes may be the only applicable rule. ☐ Notify employees the same way you would customers — ⭐ and expect more anger, because they had no choice about giving you the data. ☐ Check whether monitoring data was involved — location from vehicles or badges, keystroke or screenshot capture, biometric timeclock templates. ☐ ⚠ Biometric templates are the highest-exposure category, because state biometric statutes carry statutory damages per violation and cannot be reset like a password. ☐ Coordinate with employment counsel before communicating — see At Will Does Not Mean For Any Reason: What Actually Makes a Firing Unlawful.

If the incident involved a departing employee

☐ ⭐ Treat it as both a breach and a trade secret matter. The two analyses run in parallel and the preservation obligations are identical — see Trade Secrets and Restrictive Covenants: A Comprehensive Guide to Protection, Enforcement, and Defense. ☐ ⚠ Do not reissue the device. Image it. ☐ Determine whether personal data of third parties was in the exfiltrated files — ⭐ if so, notification obligations attach regardless of the trade secret claim.

---

Related Documents

• Data Privacy and Security: A Comprehensive Guide to Collection, Consent, Breach Response, and Enforcement
• The Data You Did Not Know They Had: How Privacy Law Actually Reaches Your Information
• The Data Privacy and Breach Response Toolkit
• The Model Said No: How Automated Decisions Are Made and How They Are Challenged
• Challenging an Automated Decision and Auditing an AI System: A Practical Checklist
• Consumer Credit Reporting and Debt Collection: A Comprehensive Guide to the FCRA, FDCPA, and Identity Theft Remedies
• Disputing a Credit Report Error and Defending a Debt Collection Suit: A Practical Checklist
• The Consumer Debt and Credit Reporting Toolkit
• The Quiet Theft: How Elder Financial Exploitation Happens and How It Is Unwound
• The Elder Financial Exploitation Response Toolkit
• Protecting Trade Secrets and Handling a Departing Employee: A Practical Checklist
• Issuing a Litigation Hold and Preserving ESI: A Practical Checklist