RM Compliance
llms.txt
Playbook/Playbook06

Incident and breach runbook

Markdown

A breach is any unauthorised access to, disclosure of, alteration of, or loss of personal data or P0 content, including a misconfiguration that exposed data even if nobody is known to have read it, a leaked token, a lost laptop with access, a vendor breach, or an email sent to the wrong recipients.

The clocks (all run in parallel)#

Regime Who Deadline Trigger
CERT-In Directions 2022 (India) CERT-In ([email protected]) 6 hours from noticing Listed incident types: data breach, data leak, unauthorised access, ransomware, compromise of systems, attacks on applications, and more. Applies to every incident of those types, not only personal data
DPDP Act and Rules (India) Data Protection Board and every affected Data Principal Immediate first notice; detailed report within 72 hours (verify final Rules text) Any personal-data breach, no risk threshold
UK GDPR ICO 72 hours from awareness Breach of UK residents' data unless unlikely to result in risk
UK GDPR Affected individuals Without undue delay High risk to the individuals
EU GDPR Lead or relevant DPA 72 hours EU residents' data unless unlikely to result in risk
FTC Health Breach Notification Rule (US) Individuals, FTC, media if 500+ in a state Without unreasonable delay, 60 days maximum; FTC within 60 days if 500+, else annual Unsecured identifiable health data from a consumer health app
US state breach laws Residents, often the state AG From "most expedient time" to 30, 45, or 60 days by state Unencrypted personal information (name plus SSN, account, medical, biometric, login credentials)
Washington MHMDA and state consumer-health laws Individuals Per state breach law Consumer health data
Payment card data (Stripe, Razorpay, card brands) Acquirer and processor Immediately Any suspected compromise of cardholder data or of systems in scope
Contracts (RM Cloud clients, Scribe and AIBookly business customers, Tulip schools) The customer Per DPA, usually 24 to 72 hours Any incident affecting their data
Platform obligations (Google API, Apple, LinkedIn, X) The platform Per terms, often 24 to 72 hours Compromise of user tokens or platform data
Australia (NDB) OAIC and individuals 30 days to assess, then promptly Likely serious harm

When in doubt, notify. Late is worse than cautious.

First hour#

  1. Declare the incident in the ops channel with a short name and a timestamp. One person is incident lead; one person is scribe. The lead's first job is to start the clocks above by writing down the time of awareness.
  2. Contain without destroying evidence: revoke the leaked credential, rotate the key, disable the endpoint, pull the tunnel hostname, block the IP at Cloudflare, put the app in read-only. Snapshot logs and disks before restarting anything. Do not wipe.
  3. Scope: which systems, which data classes, which users (by region tag), which time window, which vendors. Pull the data map for the app. Decide if P0 data (health, children, immigration, financial, credentials, message content) is involved, because that escalates every clock.
  4. Preserve: export relevant logs (180-day retention exists for this), take hashes, record who did what.
  5. Notify internally: founder, any customer-facing owner, counsel if P0 data or more than a handful of users.

First six hours#

  1. CERT-In report if the incident is a listed type. Use the CERT-In incident reporting form; include the time, affected systems, nature, and initial actions. Keep the acknowledgement.
  2. Card processors if any payment system was in scope.
  3. Contracted customers whose data is affected, per their DPA clock.
  4. Platform notifications if OAuth tokens or platform data were exposed.

First 72 hours#

  1. DPDP Board and affected principals (India users); ICO (UK users); EU DPA (EU users). Templates in 07. Content: nature of the breach, categories and approximate number of people and records, likely consequences, measures taken and proposed, contact point.
  2. Individuals: plain-language notice by email (and in-app), what happened, what data, what we did, what they should do (password reset, watch statements), how to reach us; no marketing in the message; no blaming the user.
  3. Public statement only if the scale or press interest needs it; one voice, no speculation.

Within 60 days#

  1. FTC HBNR notices and state AG notices for US users where thresholds are met; media notice for 500+ in a state.
  2. Root cause and remediation written up; fixes shipped with tests; the playbook updated if a rule was missing.
  3. Breach register entry (mandatory under UK GDPR regardless of notification): date, description, effects, actions, decisions with reasons.

Special cases#

  • Leaked secret in git: assume compromised the moment it was pushed; rotate, then scrub history only after rotation; check for use in logs; notify if the secret gave access to personal data.
  • Wrong-recipient email (the BCC leak class): notify senders and recipients affected; ask recipients to delete; log; it is a reportable breach for the exposed addresses.
  • Vendor breach (Resend, Stripe, Cloudflare, Google, Groq): the clocks run from our awareness; get the vendor's statement; we still notify our users.
  • Ransomware or destructive event: CERT-In 6 hours; do not pay without counsel; restore from tested backups; preserve encrypted copies.
  • CSAM discovered: preserve, do not distribute, restrict access, report to NCMEC (US nexus) and to local police and the cybercrime portal (India), follow Online Safety Act processes for UK; counsel immediately.
  • Law-enforcement request that looks like an incident: verify the request is genuine and has legal process before disclosing anything.
  • Availability incident without data exposure: not a breach, but RM Cloud SLA notices and status-page updates still apply; CERT-In listed types include some availability attacks (DDoS on critical infrastructure), verify.

Contacts to keep current#

  • CERT-In: [email protected], +91-1800-11-4949.
  • ICO breach reporting: ico.org.uk report-a-breach, +44 303 123 1113.
  • Data Protection Board of India: address per the Rules once operational (verify).
  • FTC HBNR: hbnr.ftc.gov notice form.
  • Stripe and Razorpay security contacts from their dashboards.
  • Cloudflare support for emergency hostname removal.
  • Counsel (India), counsel (US), counsel (UK): to be appointed, see 08.
  • Internal: founder, ops mailbox, ntfy ops topic used by RM Mail alarms.

Drill#

Twice a year: pick an app, invent a leak, run the first hour on the clock, write what broke. The first drill should be RM Health, because its clocks are the most numerous.