Generate a clean policy covering triggers, timelines, regulator and customer notifications, evidence capture, and post-incident review.

What this tool does

It assembles a breach notification policy tailored to your organization. You set definitions, notification clocks, timelines by jurisdiction, roles, evidence capture, and post-incident steps. The tool outputs a ready-to-review text you can route for approvals.

Note: Processing happens entirely in your browser. No inputs are transmitted to any server.

How to use it

• Enter company, owner, scope, and effective date.
• Define incident and personal data breach triggers that start the notification clock.
• Set timelines for regulators and affected individuals, and note any law-enforcement coordination rules.
• Assign roles for incident command, privacy/DPO, legal, communications, and vendor management.
• Specify evidence handling, forensics, record retention, and notification content.
• Generate, download, review with counsel, and publish in your policy library.

Helpful references

For alignment, compare with GDPR Articles 33–34, US federal agency guidance, and applicable state or sector rules (for example HIPAA, state breach statutes, or financial services regulations).